LAM and Integration Reference

Name of the LAM.

Class of the LAM.

Determines whether to include request HTTP headers in Moogsoft Onprem events. If set to true, exposed headers are listed under the key moog_request_headers in events.

Enables Secure Sockets Layer (SSL) certification. If you set this to True, provide SSL certificate details.

Path to the directory that contains the SSL certificates. You can use a relative path based upon the $MOOGSOFT_HOME directory. For example the default config indicates $MOOGSOFT_HOME/config.

Name of the SSL server key file.

Name of the SSL root CA file. Must reside in the location contained in path_to_ssl_files.

Defines whether to use SSL client certification.

Name of the SSL client CA file. Must reside in the location contained in path_to_ssl_files.

Sets the allowed SSL protocols.

Authentication token in the request body. Can only be used when accept_all_json = false. If you define a token you must include it in the body of all requests. You can define auth_token or header_auth_token but not both.

Authentication token in the request header. Can only be used when accept_all_json = false. If you define a token you must include it in the header of all requests. You can define auth_token or header_auth_token but not both.

Encrypted authentication token in the request body. Can only be used when accept_all_json = false. If you define a token you must include it in the body of all requests. Overrides auth_token.

Encrypted authentication token in the request header. Can only be used when accept_all_json = false. If you define a token you must include it in the header of all requests. Overrides header_auth_token.

Defines the authentication type the LAM uses.

Defines the username and password used for authentication when authentication_type is set to basic_auth_static.

Defines the claims the LAM uses when it creates JSON Web Tokens (JWT).

Example:

jwt:
{
    secretKey : "secret",
    sub       : "moogsoft",
    iss       : "moogsoft",
    aud       : "moogsoft",
    jti       : ""
}

Key the LAM uses to validate JSON Web Tokens.

Subject the LAM uses to identify JSON Web Tokens.

Issuer the LAM uses to identify JSON Web Tokens.

Audience the LAM uses to identify JSON Web Tokens.

Identifier the LAM uses to iMoogsoft Onpremdentify JSON Web Tokens.

Defines whether a hashed version of a user's password is kept in the internal cache for the duration of the connection. If set to true it enables faster event handling. If set to false users are authenticated with each request.

When set to true, the LAM can read and process incoming requests using any valid form of JSON. The LAM and LAMbot configurations define the structure of the event. Set this property to false when you can structure incoming messages in the Moogsoft Onprem format. Using the Moogsoft Onprem format allows you to use the default LAM and LAMbot configuration to accept, convert and send incoming requests to the Message Bus. See REST LAM Examples for more information.

Defines whether a JSON list is interpreted as multiple events. Set to true to allow the LAM to accept structured events from a third party and convert them into Moogsoft Onprem events.

Number of worker threads to use for processing events. If you have a large number of events and javascript logic, increase the number of threads. Also increase the thread count if a queue builds up in the LAMs. You can use the heartbeat monitor or Graze API to check the queue size.

Determines when a REST response is sent for a request.

The length of time to wait for a REST response from the Moogfarmd AlertBuilder Moolet, in seconds.

Determines when Moogfarmd acknowledges events from the LAM.

Length of time to wait between requests, in seconds. Can be overridden by request_interval in individual targets.

Number of times the LAM attempts to reconnect after connection failure. Used in conjunction with retry_interval.

Length of time to wait between reconnection attempts, in seconds. Used in conjunction with max_retries.

Length of time to wait before halting a connection or read attempt, in seconds.

Period of time for which to recover missed events, in seconds, when the LAM re-establishes a connection after a failure.

Object containing properties which allow you to specify how the LAM recovers events that were missed during a connection outage. Comment out this object to recover all missed events with no imposed waiting time.

Length of time to wait between requests, in seconds, when the LAM re-establishes a connection after a failure.

Specifies whether to disable SSL certificate validation. If set to true the data transmission between Moogsoft Onprem and the external system is not protected by the encryption protocol. Works on chains that consist of more than one certificate.

Specifies connection details for a proxy server if you want to connect to the external system through a proxy. To use, uncomment the proxy section of the file and define the host, user, port, and password or encrypted password for the proxy. Not all properties are configurable in every LAM and integration.

This property is available in multi-target LAMs. It is a top-level container defining one or more target event sources. You can specify the configuration for each target. If you don't specify a request_interval the target uses the globally defined interval. See Tokenize Source Event Data for more information.Data Parsing

If events meet the overlap_identity_fields matching criteria during this interval (in seconds), they are not treated as duplicates. Used to ensure that Moogsoft Onprem does not miss valid events.

A list of payload tokens the LAM uses to identify duplicate events when the source returns all open events and not just updated events. After the requests_overlapperiod the LAM treats events with the same overlap identity fields as duplicate events. The LAM identifies duplicates for each payload event in the previous request only. Identification is based on the token names of the returned payload, not the mapped names. For example, including $signature refers to this value in the payload, not event.value("signature").

Datadog Polling LAM Example:

overlap_identity_fields: [ "id", "alert_type", "priority" ]

SevOne LAM Example:

overlap_identity_fields: [ "id", "severity", "closed", "number" ]

Hostname of a RabbitMQ virtual host.

File that specifies the configuration of the LAM's process log. See Configure Logging for more information.