Data flow configuration for an IBM Tivoli Netcool/Impact integration

• You must have IBM Db2 installed (on a virtual machine) before proceeding. For more information, see Installing IBM Db2 .

The following steps set up the following components.

• The IBM Db2 reporter schema for issue resolution data. This schema includes tables for alerts, incidents and the adjoining tables that contain metadata detailing changes to incidents and alerts.

• An IBM Tivoli Netcool/Impact data model that specifies details needed for IBM Tivoli Netcool/Impact to connect to an IBM Db2 instance.

• IBM Tivoli Netcool/Impact data types for alerts and incidents that link to corresponding database tables in the IBM Db2 instance.

• IBM Tivoli Netcool/Impact policies that specify how to insert and update the alert and incident data into IBM Db2 instance tables.

• An IBM Tivoli Netcool/Impact integration in Concert Operate that allows Concert Operate to interact with IBM Tivoli Netcool/Impact.

• Setup "Invoke Impact" policies in Concert Operate, that runs policies in IBM Tivoli Netcool/Impact with alert and incident data.

1. Implement the Concert Operate reporting database schema so that the relevant reporting tables are in place. For more information, see Setting up the database schema.

2. Create a new data model in the IBM Tivoli Netcool/Impact GUI by selecting Database > DB2 as the data model type. This data model must specify the information needed for IBM Tivoli Netcool/Impact to connect to IBM Db2 instance. The following information is needed:

   • IBM Db2 user username
   • IBM Db2 user password
   • Hostname (IP address of the IBM Db2 instance)
   • Port number for the JDBC connection
   • The Database name where the alert and incident reporting data tables are defined
   1. Open the dialog to create the new data model and fill in the fields.
   2. Once the the relevant fields in the IBM Db2 Data Source Editor are provided, use the 'Test Connection' button to ensure that IBM Tivoli Netcool/Impact can communicate with the IBM Db2 instance.
   3. Save the new data model.

3. Create a new alerts data type under the newly made data model:

   1. Specify a name for the data type.
   2. Pick the ALERTS_REPORTER_STATUS from the Tables dropdown in the Table description section.
   3. Use the Refresh Fields button to verify that the fields and their formats match the columns and their data types in ALERTS_REPORTER_STATUS table setup in step one.
   4. Specify the UUID field as the Key Field, by clicking on the table cell and selecting the checkbox.
   5. Save the data type.

4. Create a new incidents data type under the newly made data model:

   1. Specify a name for data type.
   2. Pick the INCIDENTS_REPORTER_STATUS from Tables dropdown in the Table description section.
   3. Use the Refresh Fields button to verify that the fields and their formats match the columns and their data types in INCIDENTS_REPORTER_STATUS table setup in step one.
   4. Specify the UUID field as the Key Field, by clicking on the table cell and selecting the checkbox.
   5. Save the data type.

5. Create an IBM Tivoli Netcool/Impact policy to export the alert insert/update data into DB2 instance.

   1. Create a new JavaScript IBM Tivoli Netcool/Impact policy.

   2. Use the following example policy as the content:

      datamodel = "<datamodel>";
      dataType = "<datatype>";
      datasourceDbSchema = "<db2-schema>";
      datasourceDbTable = "ALERTS_REPORTER_STATUS";
      
      aiopsAlert = EventContainer.argumentsAsObj.eventContainer;
      
      MyAlert = NewObject();
      MyAlert.id = aiopsAlert.id;
      MyAlert.tenantid = aiopsAlert.tenantid;
      MyAlert.severity = aiopsAlert.severity;
      MyAlert.businessCriticality = aiopsAlert.businessCriticality;
      MyAlert.state = aiopsAlert.state;
      MyAlert.summary = aiopsAlert.summary;
      MyAlert.eventType = aiopsAlert.eventType;
      MyAlert.sender = aiopsAlert.sender;
      MyAlert.resource = aiopsAlert.resource;
      MyAlert.firstOccurrenceTime = aiopsAlert.firstOccurrenceTime;
      MyAlert.lastOccurrenceTime = aiopsAlert.lastOccurrenceTime;
      MyAlert.runbooks = aiopsAlert.runbooks;
      MyAlert.topology = aiopsAlert.topology;
      MyAlert.seasonal = aiopsAlert.seasonal;
      MyAlert.inIncident = aiopsAlert.inIncident;
      MyAlert.tiggerAlert = aiopsAlert.tiggerAlert;
      MyAlert.suppressed = aiopsAlert.suppressed;
      MyAlert.subTopology = aiopsAlert.subTopology;
      MyAlert.scopeGroup = aiopsAlert.scopeGroup;
      MyAlert.temporal = aiopsAlert.temporal;
      MyAlert.owner = aiopsAlert.owner;
      MyAlert.goldenSignal = aiopsAlert.goldenSignal;
      MyAlert.eventCount = aiopsAlert.eventCount;
      MyAlert.acknowledged = aiopsAlert.acknowledged;
      MyAlert.team = aiopsAlert.team;
      MyAlert.deduplicationKey = aiopsAlert.deduplicationKey;
      MyAlert.signature = aiopsAlert.signature;
      MyAlert.langId = aiopsAlert.langId;
      MyAlert.lastStateChangeTime = aiopsAlert.lastStateChangeTime;
      MyAlert.expirySeconds = aiopsAlert.expirySeconds;
      
      result = DirectSQL(
          datamodel,
          "Select id from " +    datasourceDbSchema +    "." +    datasourceDbTable +    " where id = '" +    MyAlert.id +    "'",  
          null
      );
      
      if (Length(result) > 0) {
        Filter = "id = '" + MyAlert.id + "'";
        UpdateExpression =
          "severity = " +
          MyAlert.severity +
          ", state = '" +
          MyAlert.state +
          "', acknowledged = '" +
          MyAlert.acknowledged +
          "', team = '" +
          MyAlert.team +
          "', owner = '" +
          MyAlert.owner +
          "', eventcount = " +
          MyAlert.eventCount +
          "', laststatechangetime = '" +
          MyAlert.lastStateChangeTime +
          "', lastoccurrencetime = '" +
          MyAlert.lastOccurrenceTime +
          "', inincident = '" +
          MyAlert.inIncident +
          "'";
      
        BatchUpdate(dataType, Filter, UpdateExpression);
      } else {
        AddDataItem(dataType, MyAlert);
      }
      

   3. Replace the template values for datamodel, datatype and db-schema:

      • datamodel is the name of your data model created in a previous step.
      • datatype is the name of your data type create in a previous step.
      • db-schema is the namespace under which the ALERTS_REPORTER_STATUS was instantiated in a previous step.

   4. (Optional) The UpdateExpression assumes that only the following listed fields are updated post alert creation (state, severity, acknowledge, team, owner, eventCount, lastStateChangeTime, lastOccurrenceTime, inIncident).

      If you have configured a custom field in a previous step or want another field of the alert to be kept in sync in both Concert Operate and IBM Db2, you must append the MyAlert with the custom field value MyAlert.customField = aiopsAlert.customField; and append the UpdateExpression string with the custom field values ..."', inincident = '" + MyAlert.inIncident + "', customfield = '" + MyAlert.customField + "'"

      Note: The custom field is defined by an Concert Operate policy for IBM Tivoli Netcool/Impact in a following step.

   5. Save the policy.

6. Create an IBM Tivoli Netcool/Impact policy to export the incident insert/update data into DB2 instance:

   1. Create a new JavaScript IBM Tivoli Netcool/Impact policy

   2. Use the example policy below as content:

      datamodel = "<datamodel>";
      dataType = "<datatype>";
      datasourceDbSchema = "<db2-schema>";
      datasourceDbTable = "INCIDENTS_REPORTER_STATUS";
      
      aiopsIncident = EventContainer.argumentsAsObj.eventContainer;
      
      
      MyIncident = NewObject();
      MyIncident.tenantid = aiopsIncident.tenantid;
      MyIncident.id = aiopsIncident.id;
      MyIncident.uuid = aiopsIncident.uuid;
      MyIncident.createdTime = aiopsIncident.createdTime;
      MyIncident.createdBy = aiopsIncident.createdBy;
      MyIncident.title = aiopsIncident.title;
      MyIncident.description = aiopsIncident.description;
      MyIncident.priority = aiopsIncident.priority;
      MyIncident.state = aiopsIncident.state;
      MyIncident.lastChangedTime = aiopsIncident.lastChangedTime;
      MyIncident.owner = aiopsIncident.owner;
      MyIncident.team = aiopsIncident.team;
      MyIncident.alerts = aiopsIncident.alerts;
      MyIncident.similarIncidents = aiopsIncident.similarIncidents;
      MyIncident.probableCauseAlerts = aiopsIncident.probableCauseAlerts;
      MyIncident.tickets = aiopsIncident.tickets;
      MyIncident.chatOpsIntegrations = aiopsIncident.chatOpsIntegrations;
      MyIncident.policyId = aiopsIncident.policyId;
      
      result = DirectSQL(
        datamodel,
        "Select id from " + datasourceDbSchema + "." + datasourceDbTable +  " where id = '" + MyIncident.id + "'",
        null
      );
      
      if (Length(result) > 0) {
        Filter = "id = '" + MyIncident.id + "'";
        UpdateExpression =
          "priority = " +
          MyIncident.priority +
          ", state = '" +
          MyIncident.state +
          "', alerts = '" +
          MyIncident.alerts +
          "', owner = '" +
          MyIncident.owner+
          "', team = '" +
          MyIncident.team +
          "', lastchangedtime = '" +
          MyIncident.lastChangedTime +
          "'";
      
      
        BatchUpdate(DataType, Filter, UpdateExpression);
      } else {
        AddDataItem(DataType, MyIncident);
      }
      

   3. Replace the template values for datamodel, datatype and db-schema

      • datamodel is the name of your data model that you created in a previous step.
      • datatype is the name of your data type that you created in a previous step.
      • db-schema is the namespace under which the INCIDENTS_REPORTER_STATUS was instantiated in a previous step.

   4. Save the policy.

7. Define IBM Tivoli Netcool/Impact in Concert Operate. For more information, see Netcool integrations - Integrating with IBM Tivoli Netcool/Impact .

8. Define the Invoke IBM Tivoli Netcool/Impact policy for alerts in Concert Operate. For more information, see Creating IBM Tivoli Netcool/Impact integrations.

   Important: Ensure that the IBM Tivoli Netcool/Impact integration status reports as "running" before you continue with the following steps.
   Tip: To ensure that the data is synched correctly, use the lastStateChangeTime alert property as part of the trigger definition.
   Note: If you have defined a custom field in your alert IBM Tivoli Netcool/Impact policy in a previous step, you need to ensure that the policy parameter mapping outputs the expected fields through the customization feature of the policy. For more information, see Invoke an IBM Tivoli Netcool/Impact policy - Customize. For reference, review the following example for of a required parameter mapping for an Impact policy:

   {
       "alert": {
           "id": alert.id,
           "tenantid": "cfd95b7e-3bc7-4006-a4a8-a73a79c71255",
           "uuid": $join(["cfd95b7e-3bc7-4006-a4a8-a73a79c71255", alert.id], "_"),
           "severity": alert.severity,
           "businessCriticality": $join(alert.insights[type="aiops.ibm.com/insight-type/business/criticality"].details.criticalityLabel, ','),
           "state": alert.state,
           "summary": alert.summary,
           "eventType": alert.type.classification,
           "sender": alert.sender.name,
           "resource": alert.resource.name,
           "firstOccurrenceTime": $replace($replace(alert.firstOccurrenceTime, 'T', ' '), 'Z', ''),
           "lastOccurrenceTime": $replace($replace(alert.lastOccurrenceTime, 'T', ' '), 'Z', ''),
           "runbooks": $count(alert.insights[type="aiops.ibm.com/insight-type/runbook"]),
           "topology":  $count(alert.insights[type="aiops.ibm.com/insight-type/topology/resource"]),
           "seasonal": $count(alert.insights[type="aiops.ibm.com/insight-type/seasonal-occurrence"].details[isSeasonal=true]),
           "inIncident": $count(alert.relatedContextualStoryIds) + $count(alert.relatedStoryIds),
           "triggerAlert": $count(alert.relatedStoryIds),
           "suppressed": $number(alert.suppressed),
           "subTopology": $count(alert.insights[source="aiops.ibm.com/insight-source/relationship/causal/topological-group"]),
           "scopeGroup": $count(alert.insights[source="aiops.ibm.com/insight-source/relationship/causal/custom"]),
           "temporal": $count(alert.insights[source="aiops.ibm.com/insight-source/relationship/causal/temporal"]),
           "owner": alert.owner,
           "goldenSignal": $join([alert.insights[type="aiops.ibm.com/insight-type/golden-signal"].details.goldenSignal], ","),
           "eventCount": alert.eventCount,
           "acknowledged": $number(alert.acknowledged),
           "team": alert.team,
           "deduplicationKey": alert.deduplicationKey,
           "signature": alert.signature,
           "lastStateChangeTime": $replace($replace(alert.lastStateChangeTime, 'T', ' '), 'Z', ''),
           "expirySeconds": alert.expirySeconds,
           "customField": alert.details.ticketId
       }
   }
   

9. Define the Invoke IBM Tivoli Netcool/Impact policy for incidents in AIOps Concert Operate.

   Tip: To ensure that the data is synched correctly, use the lastChangedTime property for incidents.