We have 2 correlation scripts that sends an e-mail to a robot that creates trouble tickets if there is a critical alarm which persists for 10 seconds or longer.
In the case with major incidents (alarm storm) you will have a situation where you want to stopt the Correlation script from sending e-mails for auto ticket creation.
Can we do this with an automation script? We would like to execute the script by pressing a button in a visio file. Their should be a major alarm that the correlation script is disabled.
Hi everyone,
we've had the same request in the past: is there a way to activate/deactivate a correlation rule based on a user action. Skyline actually came up with exactly what Jaques was asking for: an automation script wich enables or disables a certain correlation rule, based on the input of the script (name of the correlation rule + enable/disable value).
The scripts header does prohibit to share its content:
The content of this script is confidential information.
The user hereby agrees to keep this confidential information strictly
secret and confidential and not to disclose or reveal it, in whole
or in part, directly or indirectly to any person, entity, organization
or administration without the prior written consent of
Skyline Communications.
Anyway, here is some clue who developed this script at Skyline that was called "CorrelationRuleUpdate":
Revision History:
DATE VERSION AUTHOR COMMENTS
09/01/2023 1.0.0.1 RME, Skyline Initial version
Maybe Skyline can publish or provide this, so that this workaround (which is actually working pretty nicely) is available for other customers as well.
BR
Nils
Hi Nils,
You are absolutely right. We have now published the script we built previously. As mentioned it allows to pass the name of the script together with a parameter (enable/disable) to either enable or disable the script via automation. Easy also to launch the script from a Visio.
You can find the script in the catalog via the below link:
https://catalog.dataminer.services/details/automation-script/5966