Workflow Engine

Implementers and administrators can use a workflow engine to add custom logic for event, alert, and Situation processing in Moogsoft AIOps. You can check conditions against object data, modify object data, and control object routing. This allows you to fine-tune your Data Processing Flow. For example you can set up a workflow engine to process and normalize data from a LAM or Integration before it forwards the data to the Configure Alert Builder.

See Introduction to Workflow Engine online training for an overview of the Workflow Engine.

Some scenarios where you can implement the Workflow Engine include:

  • Using the Alert Workflow Engine to escalate alerts. For example to respond to a disk space alert.

    See Alert Workflow WFE for an example.

  • Using the Event Workflow Engine to prevent them from processing.

    See Event Workflow WFE for an example.

  • Enrich alerts with external data such as the services supported by a host or its location.

  • Using the Heartbeat Workflow Engine to detect the absence of events like a missing keep alive event from a predictable source.

    See Heartbeat Workflow WFE for an example.

  • Controlling stateful workloads. For example, you can configure a workflow to hold a "link down" event until Moogsoft AIOps receives a corresponding "link up" event within a time limit.

  • Using the Situation Workflow Engine to integrate with external systems for ticketing, notification, automation, and reporting.

    See Situation Workflow WFE for an example.

See Workflow Engine Tutorials for more examples.

Default Workflow Engine types

Each workflow engine is a Moolet that operates within the context of Moogfarmd. See Data Processing Flow for more information. Moogsoft AIOps includes the following workflow engines by default:

  • Event Workflows process events data after data after ingestion from a LAM and before the Alert Builder.

  • Enrichment Workflows process alerts after the Alert Builder but before the Maintenance Window Manager.

  • Alert Workflows process alerts after the Maintenance Window Manager and before they pass to clustering algorithms. For example, you can use an alert workflow when you want to route a specific type of alert to a specific clustering algorithm.

  • Situation Workflows process Situations after the Teams Manager. For example, you can use a Situation workflow when you want to integrate with a ticketing system.

Moogsoft periodically releases new workflow engines. See Moogsoft Add-ons for the most recent update.

Because workflow engines are Moolets, you can use a Moobot to extend the engine functionality. You can create a new Workflow Engine Moolet if the existing Moolets do not perform the service that you need. You can also add new workflow engines. For more information, see Workflow Engine Moolets.


Each workflow engine is a container for a set of workflows. In general a workflow comprises the following:

  • A workflow definition that defines the workflow purpose, the objects it affects, and some basic functionality.

  • Workflow actions that let you apply functions to object data and apply some routing rules in case the function returns false. There are functions to let you check conditions of object data within the workflow, modify the object data, and route the object within the workflow or to another Moolet.

Workflows execute in numerical order from first to last. You can rearrange the order of the workflows to control the order of execution. Similarly, within a workflow, actions execute in numerical order.

Each action within a workflow lets you control the flow in the case that its function returns false.

Moogsoft AIOps ships with the following default workflows:

  • Closed Objects Filters to prevent processing of closed ob in the Alert Workflows and Situation Workflows.

  • Automated Ticketing to help you integrate with third party ticketing systems in the Situation Workflows.

To learn how to create workflows, see Manage Workflows. For information on creating actions within a workflow, see Manage Workflow Engine Actions.