Skip to main content

Workflow Engine Functions Reference

This is a reference for Workflow Engine functions in Moogsoft Onprem.

Functions may be available for more than one object. For example, addItemToList is available in event, alert, enrichment, and Situation workflows. In this reference, the functions appear in the lists for all the objects they are valid for.

Note

The following topology-based workflow actions are not designed as a replacement or substitute for bulk loading topology data using the Topology API:

  • addTopologyLink

  • addTopologyNode

  • createTopology

  • deleteTopology

  • deleteTopologyNode

  • deleteTopologyLink

Bulk loading topology data using these actions can result in poorly maintained, inaccurate topologies, leading to inaccurate Situations and impacting system performance. Instead, you should maintain 1-to-many (1:many) relationships using the appropriate Topology API endpoints and loading workflow.

For example, the following would not be a supported use case: Enriching an alert with a list of its neighbors and attempting to maintain a topology using the topology workflow actions.

Supported use cases:

Topology-based workflow actions are designed to allow a dynamic topology to be created and maintained by events as they pass through the system. They should only be used to create or maintain single neighbor relationships (atomic changes). Supported use cases include those in which event data details both the "A" and "Z" end of a link.

For example:

  • A vMotion event that details the movement of a guest VM from one host to another

  • A BGP event indicating that a relationship exists or has ceased to exist between peers.

If you have any questions about these actions and their supported use cases, please contact your Moogsoft Onprem account team.

The following functions are available in event workflows:

Function

Description

addDefaultCustomInfoValues

Supersedes the existing addDefaultValues which used the now deprecated Payload Maps integration for the values.

addDefaultValues

Adds a set of default values to custom_info based on a payload map. Sweep up filter applies.

addItemToList

Adds an item or items to an array. Sweep up filter applies.

addLocationData

Populates the standard address fields in the standard custom_info.location object.

addTags

Adds or updates a custom info field called "tags" with an array of string values.

addToContext

Updates the workflow context with a key: value pair.

appendFields

Appends a concatenated set of fields to an existing field, using a separator character.

appendString

Appends a static string to an existing field separated by a space character.

basicMaths

Allows basic maths ( +, -, * , / , % ) to be performed on two fields that write the result to a destination field in either custom_info or the workflow context.

calculateSubnet

Generates subnet data from an IP address and a suitable network mask (either a bitmask or CIDR bit count).

ceventFilter

Returns true if the object matches a SQL-like filter. Sweep up filter applies.

checkFloodEvent

Performs a rudimentary flood check against an alert triggered by an incoming event.

checkSeverity

Checks the severity level of the object.

classifyEvent

Sets the class, type, and severity fields of an event based upon its contents using a predefined classification algorithm.

compareFields

Returns true or false based on the comparison of two string or number values.

concatFields

Sets the value of a field to a string representing a set of concatenated fields.

contextFilter

Filters a workflowContext object for a specified name field. Sweep up filter applies.

convertCustomInfoToTags

Works specifically with an alert export to Moogsoft Cloud, and “flattens” a Moogsoft Onprem custom_info object into a single-depth key:value tags object suitable for ingestion by Moogsoft Cloud Events or the Create Your Own Integration (CYOI) API.

convertField

Converts a field using mappings defined in the Conversion Maps integration tile.

convertHexToAscii

Converts a set of hex pairs to the equivalent ASCII representation.

convertMsToSeconds

Converts a millisecond timestamp to seconds.

convertObjectList

Extracts key and value pairs from a list of anonymous objects, and creates a new flatter key:value object.

convertPayloadToXML

Converts a JSON payload to an XML string using the Moobot utility jsonToXML.

convertStringToList

Converts a string of words separated by a separator character into a Javascript array (list).

convertToBoolean

Converts a string value to a Boolean (true or false) value which is similar to the $TO_BOOLEAN() payload macro.

convertToEpoch

Converts a date string to epoch seconds using an optional date mask. Sweep up filter applies.

convertToJSON

Converts the object to JSON and adds it to the workflowContext for use in subsequent actions.

copyCEventToPayload

Copies the entire CEvent object (event, alert, or Situation) as a JSON object into the appropriate workflowContext payload key for that object.

copyFieldFromAlertToEvent

Copies a single field from an existing alert to a deduplicating event for the same alert.

copyFromAlertToEvent:

Copies multiple fields from an existing alert to a deduplicating event for the alert.

copyFromContext

Copies a field from the workflowContext to a destination object field. Sweep up filter applies.

copyFromEventToAlert

Allows you to copy custom_info fields from an incoming event to the existing alert that the event would de-duplicate to.

copyToContext

Copies an object field to the workflowContext.

copyToInformPayload

An eventless clone of the copyToPayload function, copying data into the Inform payload rather than a CEvent-specific payload.

copyToPayload

Copies a value to the payload in workflowContext for the current object.

createMaintenanceWindow

Calls the MoogDb createMaintenanceWindow API call, using the same parameters.

createPayload

Creates a workflowContext payload from the triggering object using a predefined payload map.

dejaVu

Allows you to determine if a piece of data has been seen previously.

deleteEnrichment

Removes data from the enrichment datastore.

deleteObjectKeys

Removes data from the enrichment datastore.

deltaEvent

Returns true: if the specified event fields differ from corresponding fields in an existing alert, or when an error occurs in the delta check, or when no alert exists. Returns false when it detects no changes.

dnsLookup

Performs a lookup of an IP address or name to return a JSON object containing the IP address, FQDN, and name for the address.

dropEvent

Allows you to prevent further processing of an event.

estimateSeverity

Uses a predefined classification algorithm to estimate event or alert severity. Sweep up filter applies.

existingAlertFilter

Returns true if the existing alert for a deduplicating event matches a SQL-like filter.

exportViaRestWithRetry

Has the same functionality as the exportViaRest (and sendViaRest) actions, but adds the ability to retry the export on failure. Sweep up filter applies.

extractAll

Extracts all matches for the specified regular expression found in the specified field value (a string), copying the results to a new field.

flattenObject

Converts a nested JSON object (consisting of more than one level) into a flat JSON object with only a single level of depth (a key:value pairing).

formatDate

Allows an epoch date (number of seconds since 1/1/1970 00:00:00) to be formatted using a set of predefined macros. Sweep up filter applies.

getExistingAlertId

Retrieves the existing alert id for a triggering event (the alert the event would deduplicate with), and copies the id to the workflow context key workflowContext.alert_id.

getHashValue

Creates a hash value (32-bit integer) from a CEvent or WorkflowContext field value and copies it to a destination field or the source field (if no destination was specified).

getIntegrationConfiggetIntegrationConfig

Retrieves an integration configuration and stores it in the workflowContext for subsequent actions to use.

getObjectValuesFromList

Allows keys to be extracted from a list of anonymous objects based on a “trigger” key and value.

getPayload

Creates a workflowContext payload from the triggering object from a predefined payload map. Sweep up filter applies.

getPayloadFromInform

Has the same functionality as the getPayload function, but instead of creating a payload from an in-scope CEvent object (event, alert or situation), the payload is created from the workflowContext object.

isClear

Returns true if the object's severity level is Clear (0).

isInSubnet

Returns true when an IP address is present within a specified subnet. Sweep up filter applies.

isNewerThan

Returns true when the object age in seconds is less than a specified age in seconds. Sweep up filter applies.

isNotClear

Returns true if the object's severity level is not "Clear". Sweep up filter applies.

isNotNull

Returns true if the value for an object's cEvent field is not null, is not an empty object, or is not an empty array.

isNull

Returns true if the value for an object's cEvent field is null, is not set, is an empty object, or is an empty array.

isOlderThan

Returns true when the object age in seconds is older than a specified age in seconds. Sweep up filter applies.

listContains

Returns true when the array field you query contains some of your specified values. Sweep up filter applies.

listContainsAll

Returns true when the array field you query contains all of your specified values. Sweep up filter applies.

listDoesNotContain

Returns true when the array field you query contains none of your specified values. Sweep up filter applies.

logCEvent

Prints a warning level message containing the current in-scope object in a readable JSON format to the Moogfarmd log file. Sweep up filter applies.

logWorkflowDuration

Logs debug messages for the workflow execution duration.

lowerCase

Changes the value of a field to lower case. Sweep up filter applies.

mapEvent

Allows you to map an event in the Event Workflow engine using a configured Payload map.

mergeList

Merges two or more array fields. Sweep up filter applies.

notBetween

The “negative” of the between function, returning true if the object creation date is outside the specified range.

parseOverflow

Parses the event.overflow field into a JSON object and copies the resulting object into the workflowContext.overflow object.

populateNamedTopology

Populates the named topology field custom_info.moog_topology with a value. It can be a string value or the value of an alert attribute. Sweep up filter applies.

prependFields

Prepends a concatenated set of fields to an existing field, using a separator character.

prependString

Prepends a string to an existing field, using a separator character.

reduceObjectsList

Reduces a list of objects into single object of merged key value pairs.

removeEmptyPayloadValues

Removes empty values from a JSON object, specifically designed to remove empty values from payloads (in the workflowContext) created by the getPayload, or getPayloadFromInform functions. Sweep up filter applies.

removeEmptyValues

Removes empty values from a JSON object. Sweep up filter applies.

removeItemsFromList

Removes a set of specified items from an existing list and write the resulting list back to the source field, or optionally to a different destination field.

restAsyncPost

Makes a HTTP POST request with a JSON payload to a named REST endpoint.

searchAndReplace

Matches a regular expression to an object field and maps the contents of subgroups to other fields. Sweep up filter applies.

searchAndReplaceOrdered

Matches a regular expression to an object field and maps the contents of subgroups to other fields. Allows you to provide the map as an array to preserve mapping order. Sweep up filter applies.

sendToCloud

Builds a payload from a CEvent object and exports it (via REST) to a configured Moogsoft Cloud endpoint.

sendToWorkflow

Sends the in-scope object to a named workflow in an Inform based workflow engine.

setAgent

Sets the agent of the event or alert.

setAgentLocation

Sets the agent location of the event or alert.

setAgentTime

Sets the agent_time of the event to current time if the field does not exist in the event, or is more than the offset seconds in the past/future.

setEnrichment

Updates a single record in the enrichment datastore with data from an alert.

setEnrichmentBulk

Updates multiple records in the enrichment datastore with an array of data from an alert.

setExternalId

Sets the external ID of the event or alert.

setManager

Sets the manager of the event or alerts.

setSource

Sets the source of the event or alert.

setSourceId

Sets the source ID of the event or alert.

setCoreEventField

Sets a single core event field to a value.

simpleLookup

Defines the lookup as two arrays of equal length. Sweep up filter applies.

skip

Forwards an in-scope event, alert or Situation to the next chained Moolet using the standard forwarding mechanism, and skips the rest of the workflows in the current engine.

sortList

Sorts a JavaScript array (a list) using the standard Array.sort() function.

staticLookup

Searches for a key in a static lookup table, retrieves the corresponding value, and applies that value to a field in the object.

stop

Stops the workflow.

stripFQDN

Splits a fully qualified domain name (FQDN) into a hostname/short name and a domain name and updates fields with the values.

substringValue

Substrings a value to the specified limit (or the closest preceding whitespace), then copies the result to either the optional destination field, or overwrites the source field.

upperCase

Changes the value of a field to uppercase. Sweep up filter applies.

validateEvent

Validates an event prior to deduplication to ensure that the event can be processed.

willCreateNewAlert

Returns true if the event will create a new alert.

willDeduplicateAlert

Returns true if the event will deduplicate into an existing alert.

workflowContextSearchAndReplace

Works only on fields within the workflowContext. The extracted fields are copied into a fixed workflowContext location: workflowContext.extract.

xinyState

Returns true if it detects that an alert is “flapping” (repeatedly changing state from “down” to “up” or "up" to "down"), and returns false if flapping is not detected, or if an alert that was previously flapping is no longer flapping.

The following functions are available in alert and enrichment workflows:

Function

Description

ackNotification

Automatically acknowledges a notification for a service.

activateTopology

Updates a named topology from an inactive to an active state.

addDefaultCustomInfoValues

Supersedes the existing addDefaultValues which used the now deprecated Payload Maps integration for the values.

addDefaultValues

Adds a set of default values to custom_info based on a payload map. Sweep up filter applies.

addItemToList

Adds an item or items to an array. Sweep up filter applies.

addLocationData

Populates the standard address fields in the standard custom_info.location object.

addRestHeader

Adds additional headers to an outbound request in a exportViaRest or sendViaRest workflow.

addTags

Adds or updates a custom info field called "tags" with an array of string values.

addToContext

Updates the workflow context with a key: value pair.

addTopologyLink

Creates a link between two endpoints, A (source node) and Z (sink node), in a named topology.

addTopologyNode

Creates a node in a named topology.

alertDelta

Returns true when attributes have changed.

alertInSituation

Returns true when the alert is a member of an active Situation. Sweep up filter applies.

alertNotInSituation

Returns true when the alert is not a member of an active Situation. Sweep up filter applies.

appendFields

Appends a concatenated set of fields to an existing field, using a separator character.

appendString

Appends a static string to an existing field separated by a space character.

assignAlert

Assigns an owner of in-scope alerts. Sweep up filter applies.

assignAndAcknowledge

Assigns and acknowledges the specified user as the owner of the alerts or Situations in scope.

basicMaths

Allows basic maths ( +, -, * , / , % ) to be performed on two fields that write the result to a destination field in either custom_info or the workflow context.

between

Returns true if the object creation date falls between two times.

calculateSubnet

Generates subnet data from an IP address and a suitable network mask (either a bitmask or CIDR bit count).

ceventFilter

Returns true if the object matches a SQL-like filter. Sweep up filter applies.

checkSeverity

Checks the severity level of the object.

checkTopology

Checks for the existence of a named topology.

checkTopologyLink

Checks for a link between two endpoints, A (source node) and Z (sink node), in a named topology.

cloneTopology

Copies an existing topology to a new inactive named topology if the name is not already in use.

closeAlert

Closes alerts.

closeServiceNowIncident

Sends an incident close request to ServiceNow.

closeWebexIncident

Notifies Webex when a Situation or alert is closed or resolved.

compareFields

Returns true or false based on the comparison of two string or number values.

concatFields

Sets the value of a field to a string representing a set of concatenated fields.

contextFilter

Filters a workflowContext object for a specified name field. Sweep up filter applies.

convertCustomInfoToTags

Works specifically with an alert export to Moogsoft Cloud, and “flattens” a Moogsoft Onprem custom_info object into a single-depth key:value tags object suitable for ingestion by Moogsoft Cloud Events or the Create Your Own Integration (CYOI) API.

convertField

Converts a field using mappings defined in the Conversion Maps integration tile.

convertHexToAscii

Converts a set of hex pairs to the equivalent ASCII representation.

convertMsToSeconds

Converts a millisecond timestamp to seconds.

convertObjectList

Extracts key and value pairs from a list of anonymous objects, and creates a new flatter key:value object.

convertPayloadToXML

Converts a JSON payload to an XML string using the Moobot utility jsonToXML.

convertStringToList

Converts a string of words separated by a separator character into a Javascript array (list).

convertToBoolean

Converts a string value to a Boolean (true or false) value which is similar to the $TO_BOOLEAN() payload macro.

convertToEpoch

Converts a date string to epoch seconds using an optional date mask. Sweep up filter applies.

convertToJSON

Converts the object to JSON and adds it to the workflowContext for use in subsequent actions.

copyCEventToPayload

Copies the entire CEvent object (event, alert, or Situation) as a JSON object into the appropriate workflowContext payload key for that object.

copyFromContext

Copies a field from the workflowContext to a destination object field. Sweep up filter applies.

copyToContext

Copies an object field to the workflowContext.

copyToInformPayload

An eventless clone of the copyToPayload function, copying data into the Inform payload rather than a CEvent-specific payload.

copyToPayload

Copies a value to the payload in workflowContext for the current object.

createMaintenanceWindow

Calls the MoogDb createMaintenanceWindow API call, using the same parameters.

createNotification

Automatically creates a notification for a service.

createPayload

Creates a workflowContext payload from the triggering object using a predefined payload map.

createServiceNowIncident

Sends an incident to create request to ServiceNow.

createTopology

Creates a named topology if it does not already exist. Takes no action if the topology exists.

createWebexIncident

Creates a new Webex Incident notification.

deactivateTopology

Updates a named topology from an active to an inactive state.

deassignAlert

Removes the current owner of in-scope alerts. Sweep up filter applies.

dejaVu

Allows you to determine if a piece of data has been seen previously.

deleteEnrichment

Removes data from the enrichment datastore.

deleteObjectKeys

Allows deletion of keys from an object.

deleteTopology

Delete a named topology.

deleteTopologyLink

Removes a direct link between two endpoints, A (source node) and Z (sink node), in a named topology.

deleteTopologyNode

Deletes a node in a named topology.

dnsLookup

Performs a lookup of an IP address or name to return a JSON object containing the IP address, FQDN, and name for the address.

doesNotHaveStatus

Returns true when the in-cope alert or Situation is not in any of the specified states.

enteringMaintenanceWindow

Returns true if it detects that an alert has entered a maintenance window.

estimateSeverity

Uses a predefined classification algorithm to estimate event or alert severity. Sweep up filter applies.

exportViaJDBC

Exports alert and Situation data to an external JDBC endpoint.

exportViaKafka

Exports the payload from a createPayload to an external Kafka endpoint. Sweep up filter applies.

exportViaRest

Exports the payload from a createPayload to an external REST endpoint. Sweep up filter applies.

exportViaRestWithRetry

Has the same functionality as the exportViaRest (and sendViaRest) actions, but adds the ability to retry the export on failure. Sweep up filter applies.

extractAll

Extracts all matches for the specified regular expression found in the specified field value (a string), copying the results to a new field.

flattenObject

Converts a nested JSON object (consisting of more than one level) into a flat JSON object with only a single level of depth (a key:value pairing).

formatDate

Allows an epoch date (number of seconds since 1/1/1970 00:00:00) to be formatted using a set of predefined macros. Sweep up filter applies.

forward

Forwards the object to the named Moolet.

getEnrichment

Retrieves data from the enrichment datastore through the Moogsoft Onprem Enrichment API. Sweep up filter applies.

getHashValue

Creates a hash value (32-bit integer) from a CEvent or WorkflowContext field value and copies it to a destination field or the source field (if no destination was specified).

getIntegrationConfiggetIntegrationConfig

Retrieves an integration configuration and stores it in the workflowContext for subsequent actions to use.

getObjectValuesFromList

Allows keys to be extracted from a list of anonymous objects based on a “trigger” key and value.

getPayload

Creates a workflowContext payload from the triggering object from a predefined payload map. Sweep up filter applies.

getPayloadFromInform

Has the same functionality as the getPayload function, but instead of creating a payload from an in-scope CEvent object (event, alert or situation), the payload is created from the workflowContext object.

getSituationDetailsForAlert

Retrieves the specified Situation attributes for the Situation that the triggering alert belongs to, and writes these details into the workflowContext for use in subsequent actions.

getUserDetails

Retrieves the full Moogsoft user record from a supplied uid and copies the retrieved data to the workflowContext.userDetails key for use in subsequent actions within the workflow.

getViaRest

Receives a JSON payload or results from a REST endpoint and sets the results under workflowContext.values.<endpointname>.

hasNotSweptUp

Returns true if the workflow entry filter did not sweep up any alerts or Situations.

hasStatus

Returns true when the in-scope alert or Situation is in any of the specified states.

hasSweptUp

Returns true if the workflow entry filter swept up any alerts or Situations.

isAssigned

Returns true if the object has an owner or moderator. Sweep up filter applies.

isClear

Returns true if the object's severity level is Clear (0).

isInSubnet

Returns true when an IP address is present within a specified subnet. Sweep up filter applies.

isNewerThan

Returns true when the object age in seconds is less than a specified age in seconds. Sweep up filter applies.

isNotAssigned

Returns true if the object does not have an owner or moderator. Sweep up filter applies.

hasSweptUp

Returns true if the workflow entry filter swept up any alerts or Situations.

isNotClear

Returns true if the object's severity level is not "Clear". Sweep up filter applies.

isNotNull

Returns true if the value for an object's cEvent field is not null, is not an empty object, or is not an empty array.

isNull

Returns true if the value for an object's cEvent field is null, is not set, is an empty object, or is an empty array.

isOlderThan

Returns true when the object age in seconds is older than a specified age in seconds. Sweep up filter applies.

leavingMaintenanceWindow

Returns true if it detects that an alert has left a maintenance window.

listContains

Returns true when the array field you query contains some of your specified values. Sweep up filter applies.

listContainsAll

Returns true when the array field you query contains all of your specified values. Sweep up filter applies.

listDoesNotContain

Returns true when the array field you query contains none of your specified values. Sweep up filter applies.

logCEvent

Prints a warning level message containing the current in-scope object in a readable JSON format to the Moogfarmd log file. Sweep up filter applies.

logMessage

Logs a message to the Moogfarmd log.

logWorkflowContext

Logs the contents of workflowContext to the current Moogfarmd log file at a warning level.

logWorkflowDuration

Logs debug messages for the workflow execution duration.

lookupAndReplace

Sets the alertField to a value when one of the fields in the inFields list matches a word or regular expression. Sweep up filter applies.

lowerCase

Changes the value of a field to lower case. Sweep up filter applies.

mergeList

Merges two or more array fields. Sweep up filter applies.

mergeSituations

Merges two or more Situations, creating a new Situation, and optionally keeps the original (source) Situations open. Sweep up filter applies.

notBetween

The “negative” of the between function, returning true if the object creation date is outside the specified range.

notifySlack

Sends a request to Slack channel(s).

populateNamedTopology

Populates the named topology field custom_info.moog_topology with a value. It can be a string value or the value of an alert attribute. Sweep up filter applies.

prependFields

Prepends a concatenated set of fields to an existing field, using a separator character.

prependString

Prepends a string to an existing field, using a separator character.

processAyehuAutomationResponse

Processes the automation results response sent by Ayehu using a workflow inform.

reduceObjectsList

Reduces a list of objects into single object of merged key value pairs.

removeEmptyPayloadValues

Removes empty values from a JSON object, specifically designed to remove empty values from payloads (in the workflowContext) created by the getPayload, or getPayloadFromInform functions. Sweep up filter applies.

removeEmptyValues

Removes empty values from a JSON object. Sweep up filter applies.

removeItemsFromList

Removes a set of specified items from an existing list and write the resulting list back to the source field, or optionally to a different destination field.

replaceString

Replaces a string or regular expression in a field with a specified string or regular expression.

resolveNotification

Automatically resolves a notification for a service.

resolveServiceNowIncident

Sends an incident resolve request to ServiceNow.

restAsyncPost

Makes a HTTP POST request with a JSON payload to a named REST endpoint.

searchAndReplace

Matches a regular expression to an object field and maps the contents of subgroups to other fields. Sweep up filter applies.

searchAndReplaceOrdered

Matches a regular expression to an object field and maps the contents of subgroups to other fields. Allows you to provide the map as an array to preserve mapping order. Sweep up filter applies.

sendAlertToWorkflow

Allows a triggering CEvent (alert or Situation) to send an alternative alert to a target workflow.

sendAssignedToServiceNowIncident

Sends an assignment request to related ServiceNow incidents.

sendAssignedToWebexIncident

Notifies Webex when a situation or alert is assigned.

sendAyehuAutomationRequest

Sends an automation request to Ayehu.

sendEmail

Specifies the email server instance defined in the integrations UI, the email address(s), email subject, and email message that will be used for the email request.

sendEmailFromInform

Sends an action-specific email using a predefined email server.

sendEmailUsingTemplate

Specifies the email server instance and message template defined in the integrations UI, and the email address(s) that will be used for an email request.

sendEmailUsingTemplateFromInform

Sends an email using a predefined message template.

sendMooletInform

Sends a Moolet inform with a subject and details.

sendSituationsToWorkflow

Sends the member alert of active Situations to a named workflow within a named Inform based workflow engine using the moogdb sendToWorkflow API call.

sendSituationToWorkflow

Allows a triggering CEvent (alert or Situation) to send an alternative Situation to a target workflow.

sendToCloud

Builds a payload from a CEvent object and exports it (via REST) to a configured Moogsoft Cloud endpoint.

sendToWorkflow

Sends the in-scope object to a named workflow in an Inform based workflow engine.

sendViaRest

Sends the payload from a createPayload to an external REST endpoint. Sweep up filter applies.

sendViaRestWithRetry

Has the same functionality as the sendViaRest function (a clone of exportViaRest), but adds the ability to retry the export on failure.

setAgent

Sets the agent of the event or alert.

setAgentLocation

Sets the agent location of the event or alert.

setClass

Sets the class of the alert.

setCustomInfoJSONValue

Adds or updates a custom info key to the specified JSON value. Sweep up filter applies.

setCustomInfoValue

Adds or updates a custom info key to a specified string value. Sweep up filter applies.

setDescription

Sets the description of the object.

setEnrichment

Updates a single record in the enrichment datastore with data from an alert.

setEnrichmentBulk

Updates multiple records in the enrichment datastore with an array of data from an alert.

setExternalId

Sets the external ID of the event or alert.

setManager

Sets the manager of the event or alerts.

setServiceNowPayload

Sets the payload used in the subsequent create, resolve, close, or update request to ServiceNow.

setSlackTarget

Sets the target Slack channel and title for a message payload.

setSource

Sets the source of the event or alert.

setSourceId

Sets the source ID of the event or alert.

setSeverity

Sets the severity of the alert. Sweep up filter applies.

setType

Sets the type of the alert.

simpleLookup

Defines the lookup as two arrays of equal length. Sweep up filter applies.

skip

Forwards an in-scope event, alert or Situation to the next chained moolet using the standard forwarding mechanism, and skips the rest of the workflows in the current engine.

sortList

Sorts a JavaScript array (a list) using the standard Array.sort() function.

staticLookup

Searches for a key in a static lookup table, retrieves the corresponding value, and applies that value to a field in the object.

stop

Stops the workflow.

stripFQDN

Splits a fully qualified domain name (FQDN) into a hostname/short name and a domain name and updates fields with the values.

substringValue

Substrings a value to the specified limit (or the closest preceding whitespace), then copies the result to either the optional destination field, or overwrites the source field.

testSendEmail

Specifies an email server instance as defined in the integrations UI.

updateServiceNowConfig

Sends an update request to ServiceNow for the Moogsoft Properties (part of the Moogsoft update set for ServiceNow Management integration).

updateServiceNowIncident

Sends an incident update request to ServiceNow.

upperCase

Changes the value of a field to uppercase. Sweep up filter applies.

workflowContextSearchAndReplace

Works only on fields within the workflowContext. The extracted fields are copied into a fixed workflowContext location: workflowContext.extract.

xinyClose

Clears out any cached xiny data for the in-scope alert.

The following functions are available in Situation workflows:

Function

Description

ackNotification

Automatically acknowledges a notification for a service.

addCorrelationInfo

Adds an External ID to a Situation.

addDefaultCustomInfoValues

Supersedes the existing addDefaultValues which used the now deprecated Payload Maps integration for the values.

addDefaultValues

Adds a set of default values to custom_info based on a payload map. Sweep up filter applies.

addItemToList

Adds an item or items to an array. Sweep up filter applies.

addLocationData

Populates the standard address fields in the standard custom_info.location object.

addRestHeader

Adds additional headers to an outbound request in a exportViaRest or sendViaRest workflow.

addTags

Adds or updates a custom info field called "tags" with an array of string values.

addThreadEntry

Adds a post to the named thread in the Collaboration tab of the Situation Room.

addToContext

Updates the workflow context with a key: value pair.

appendFields

Appends a concatenated set of fields to an existing field, using a separator character.

appendString

Appends a static string to an existing field separated by a space character.

assignAndAcknowledge

Assigns and acknowledges the specified user as the owner of the alerts or Situations in scope.

assignModerator

Assigns a user as the moderator of the Situations in scope.

basicMaths

Allows basic maths ( +, -, * , / , % ) to be performed on two fields that write the result to a destination field in either custom_info or the workflow context.

between

Returns true if the object creation date falls between two times.

calculateSubnet

Generates subnet data from an IP address and a suitable network mask (either a bitmask or CIDR bit count).

ceventFilter

Returns true if the object matches a SQL-like filter. Sweep up filter applies.

checkSeverity

Checks the severity level of the object.

checkSituationFlag

Checks if a specific flag is set for a Situation.

checkSituationState

Returns true if the specified state exists for a Situation. Sweep up filter applies.

closeServiceNowIncident

Sends an incident close request to ServiceNow.

closeWebexIncident

Notifies Webex when a Situation or alert is closed or resolved.

compareFields

Returns true or false based on the comparison of two string or number values.

concatFields

Sets the value of a field to a string representing a set of concatenated fields.

containsAlertDetails

Returns true if all or any of the alerts in the Situation matches the filter condition. Sweep up filter applies.

contextFilter

Filters a workflowContext object for a specified name field. Sweep up filter applies.

convertCustomInfoToTags

Works specifically with an alert export to Moogsoft Cloud, and “flattens” a Moogsoft Onprem custom_info object into a single-depth key:value tags object suitable for ingestion by Moogsoft Cloud Events or the Create Your Own Integration (CYOI) API.

convertField

Converts a field using mappings defined in the Conversion Maps integration tile.

convertHexToAscii

Converts a set of hex pairs to the equivalent ASCII representation.

convertMsToSeconds

Converts a millisecond timestamp to seconds.

convertObjectList

Extracts key and value pairs from a list of anonymous objects, and creates a new flatter key:value object.

convertPayloadToXML

Converts a JSON payload to an XML string using the Moobot utility jsonToXML.

convertStringToList

Converts a string of words separated by a separator character into a Javascript array (list).

convertToBoolean

Converts a string value to a Boolean (true or false) value which is similar to the $TO_BOOLEAN() payload macro.

convertToEpoch

Converts a date string to epoch seconds using an optional date mask. Sweep up filter applies.

convertToJSON

Converts the object to JSON and adds it to the workflowContext for use in subsequent actions.

copyCEventToPayload

Copies the entire CEvent object (event, alert, or Situation) as a JSON object into the appropriate workflowContext payload key for that object.

copyFromContext

Copies a field from the workflowContext to a destination object field. Sweep up filter applies.

copyOnMerge

Copies data from child Situations to the parent Situation when a manual merge is performed.

copyToContext

Copies an object field to the workflowContext.

copyToInformPayload

An eventless clone of the copyToPayload function, copying data into the Inform payload rather than a CEvent-specific payload.

copyToPayload

Copies a value to the payload in workflowContext for the current object.

createMaintenanceWindow

Calls the MoogDb createMaintenanceWindow API call, using the same parameters.

createNotification

Automatically creates a notification for a service.

createPayload

Creates a workflowContext payload from the triggering object using a predefined payload map.

createServiceNowIncident

Sends an incident to create request to ServiceNow.

createServiceTicket

Creates a ticket for the specified service.

createWebexIncident

Creates a new Webex Incident notification.

dejaVu

Allows you to determine if a piece of data has been seen previously.

deleteObjectKeys

Allows deletion of keys from an object.

dnsLookup

Performs a lookup of an IP address or name to return a JSON object containing the IP address, FQDN, and name for the address.

doesNotHaveCorrelationInfo

Returns true if a Situation does not have a specific item set.

doesNotHaveStatus

Returns true when the in-cope alert or Situation is not in any of the specified states.

exportViaJDBC

Exports alert and Situation data to an external JDBC endpoint.

exportViaKafka

Exports the payload from a createPayload to an external Kafka endpoint. Sweep up filter applies.

exportViaRest

Exports the payload from a createPayload to an external REST endpoint. Sweep up filter applies.

exportViaRestWithRetry

Has the same functionality as the exportViaRest (and sendViaRest) actions, but adds the ability to retry the export on failure. Sweep up filter applies.

extractAll

Extracts all matches for the specified regular expression found in the specified field value (a string), copying the results to a new field.

filterByCookbook

Returns true if the Visualize data for the Situation matches the cookbook name.

filterByCookbookAndRecipe

Returns true if the Visualize data for the Situation matches the cookbook name and recipe name.

filterByRecipe

Returns true if the Visualize data for the Situation matches the recipe name.

flattenObject

Converts a nested JSON object (consisting of more than one level) into a flat JSON object with only a single level of depth (a key:value pairing).

formatDate

Allows an epoch date (number of seconds since 1/1/1970 00:00:00) to be formatted using a set of predefined macros. Sweep up filter applies.

forward

Forwards the object to the named Moolet.

getCorrelationInfo

Checks whether correlation info exists for a Situation.

getEnrichment

Retrieves data from the enrichment data store through the Enrichment API.

getHashValue

Creates a hash value (32-bit integer) from a CEvent or WorkflowContext field value and copies it to a destination field or the source field (if no destination was specified).

getIntegrationConfiggetIntegrationConfig

Retrieves an integration configuration and stores it in the workflowContext for subsequent actions to use.

getObjectValuesFromList

Allows keys to be extracted from a list of anonymous objects based on a “trigger” key and value.

getPayload

Creates a workflowContext payload from the triggering object from a predefined payload map. Sweep up filter applies.

getPayloadFromInform

Has the same functionality as the getPayload function, but instead of creating a payload from an in-scope CEvent object (event, alert or situation), the payload is created from the workflowContext object.

getSituationFlags

Retrieves the Situation flags and stores them in the workflowContext for subsequent actions to use.

getThreadEntry

Returns a thread entry for a thread in a Situation.

getUserDetails

Retrieves the full Moogsoft user record from a supplied uid and copies the retrieved data to the workflowContext.userDetails key for use in subsequent actions within the workflow.

getViaRest

Receives a JSON payload or results from a REST endpoint and sets the results under workflowContext.values.<endpointname>.

getVisualizationData

Retrieves the Visualize data and stores them in the workflowContext for subsequent actions to use.

hasCausalPRC

Returns true if one or more alerts in the Situation has a causal PRC flag set. Sweep up filter applies.

hasCorrelationInfo

Returns true if a Situation has a specific item set.

hasMerged

Returns true if the Situation has been merged or superseded.

hasNotMerged

Returns true if the Situation has not been merged or superseded.

hasNotSweptUp

Returns true if the workflow entry filter did not sweep up any alerts or Situations.

hasPRCAlert

Returns true if a situation has at least one alert with a PRC value set (an rc_probability).

hasSimilarSituations

Returns true when the Situation has a similar Situation above the specified threshold.

hasStatus

Returns true when the in-scope alert or Situation is in any of the specified states.

hasSymptomPRC

Returns true if a Situation has at least one Symptom PRC label set for its alerts.

haveServicesChanged

Detects whether the Services for a Situation have changed (added to or removed from).

haveSituationClsChanged

Detects whether the CIs within a Situation changed when an alert is added to the Situation (manually, from a Sigaliser, or via APIs).

haveTeamsChanged

Detects any changes to a Situation’s Teams.

isAlertAcknowledged

Returns true when the in-scope alert state is Acknowledged.

isAlertNotAcknowledged

Returns true when the in-scope alert state is not Acknowledged.

isAssigned

Returns true if the object has an owner or moderator. Sweep up filter applies.

isClear

Returns true if the object's severity level is Clear (0).

isNewerThan

Returns true when the object age in seconds is less than a specified age in seconds. Sweep up filter applies.

isNotAssigned

Returns true if the object does not have an owner or moderator. Sweep up filter applies.

isNotClear

Returns true if the object's severity level is not "Clear". Sweep up filter applies.

isNotNull

Returns true if the value for an object's cEvent field is not null, is not an empty object, or is not an empty array.

isNull

Returns true if the value for an object's cEvent field is null, is not set, is an empty object, or is an empty array.

isOlderThan

Returns true when the object age in seconds is older than a specified age in seconds. Sweep up filter applies.

isPrimaryTeamSet

Returns true if the primary team for a Situation is set.

labelSituation

Labels the Situation using the Situation Manager Labeler macro language. Sweep up filter applies.

listContains

Returns true when the array field you query contains some of your specified values. Sweep up filter applies.

listContainsAll

Returns true when the array field you query contains all of your specified values. Sweep up filter applies.

listDoesNotContain

Returns true when the array field you query contains none of your specified values. Sweep up filter applies.

listSituationAlertIds

Adds the current alert Ids in the Situation into the workflow context under situationAlertIds.

listSituationHosts

Adds the current host names in the Situation into the workflow context under situationHosts.

logCEvent

Prints a warning level message containing the current in-scope object in a readable JSON format to the Moogfarmd log file. Sweep up filter applies.

logMessage

Logs a message to the Moogfarmd log.

logWorkflowContext

Logs the contents of workflowContext to the current Moogfarmd log file at a warning level.

logWorkflowDuration

Logs debug messages for the workflow execution duration.

lowerCase

Changes the value of a field to lower case. Sweep up filter applies.

mergeList

Merges two or more array fields. Sweep up filter applies.

mergeSituations

Merges two or more Situations, creating a new Situation, and optionally keeps the original (source) Situations open. Sweep up filter applies.

moveSituationToCategory

Moves a Situation to the specified category (Created, Detected, Superseded, Closed). Sweep up filter applies.

notBetween

The “negative” of the between function, returning true if the object creation date is outside the specified range.

notifySlack

Sends a request to Slack channel(s).

prependFields

Prepends a concatenated set of fields to an existing field, using a separator character.

prependString

Prepends a string to an existing field, using a separator character.

processAyehuAutomationResponse

Processes the automation results response sent by Ayehu using a workflow inform.

receiveUpdateFromWebexIncident

Handles incoming notifications from Webex.

reduceObjectsList

Reduces a list of objects into single object of merged key value pairs.

removeCorrelationInfo

Removes Situation Correlation Info (sigCorrelationInfo) for the specified service, and optionally for a specified external_id within that service.

removeEmptyPayloadValues

Removes empty values from a JSON object, specifically designed to remove empty values from payloads (in the workflowContext) created by the getPayload, or getPayloadFromInform functions. Sweep up filter applies.

removeEmptyValues

Removes empty values from a JSON object. Sweep up filter applies.

removeItemsFromList

Removes a set of specified items from an existing list and write the resulting list back to the source field, or optionally to a different destination field.

removeMatchingSituationFlags

Allows a set of Situation flags to be removed simultaneously based on a regular expression match.

removeSituationFlag

Removes a specific flag from a Situation.

replaceString

Replaces a string or regular expression in a field with a specified string or regular expression.

resolveNotification

Automatically resolves a notification for a service.

resolveServiceNowIncident

Sends an incident resolve request to ServiceNow.

resolveSituation

Marks in-scope Situations as Resolved if they match the workflow's entry filter and sweep up filter.

restAsyncPost

Makes a HTTP POST request with a JSON payload to a named REST endpoint.

reviveSituation

Revives (sets to Open) a Situation that is currently set to Resolved.

searchAndReplace

Matches a regular expression to an object field and maps the contents of subgroups to other fields. Sweep up filter applies.

searchAndReplaceOrdered

Matches a regular expression to an object field and maps the contents of subgroups to other fields. Allows you to provide the map as an array to preserve mapping order. Sweep up filter applies.

sendAddedAlertsToWorkflow

Allows alerts to be sent to a named workflow (using the sendToWorkflow function) when they are added to a Situation.

sendAlertsToWorkflow

Sends Situation alerts to a named workflow within a named Inform based workflow engine using the moogdb sendToWorkflow API call.

sendAlertToWorkflow

Allows a triggering CEvent (alert or Situation) to send an alternative alert to a target workflow.

sendAssignedToServiceNowIncident

Sends an assignment request to related ServiceNow incidents.

sendAssignedToWebexIncident

Notifies Webex when a situation or alert is assigned.

sendAyehuAutomationRequest

Sends an automation request to Ayehu.

sendEmail

Specifies the email server instance defined in the integrations UI, the email address(s), email subject, and email message that will be used for the email request.

sendEmailFromInform

Sends an action-specific email using a predefined email server.

sendEmailUsingTemplate

Specifies the email server instance and message template defined in the integrations UI, and the email address(s) that will be used for an email request.

sendEmailUsingTemplateFromInform

Sends an email using a predefined message template.

sendMooletInform

Sends a Moolet inform with a subject and details.

sendSituationToWorkflow

Allows a triggering CEvent (alert or Situation) to send an alternative Situation to a target workflow.

sendTeamsAddedToWebexIncident

Notifies Webex when Teams are added to a Situation.

sendThreadEntries

Sends all thread entries from the specified threads for the in-scope Situation to a named workflow in an inform-based workflow engine.

sendThreadEntryToServiceNowIncident

Sends an incident work note to ServiceNow when a collaboration entry is posted in a Moogsoft Situation with related incidents.

sendThreadEntryToWebexIncident

Sends a reply to the corresponding Webex incident message. Sweep up filter applies.

sendToCloud

Builds a payload from a CEvent object and exports it (via REST) to a configured Moogsoft Cloud endpoint.

sendToWorkflow

Sends the in-scope object to a named workflow in an Inform based workflow engine.

sendViaRest

Sends the payload from a createPayload to an external REST endpoint. Sweep up filter applies.

sendViaRestWithRetry

Has the same functionality as the sendViaRest function (a clone of exportViaRest), but adds the ability to retry the export on failure.

setCustomInfoJSONValue

Adds or updates a custom info key to the specified JSON value. Sweep up filter applies.

setCustomInfoValue

Adds or updates a custom info key to a specified string value. Sweep up filter applies.

setDescription

Sets the description of the object.

setServiceNowPayload

Sets the payload used in the subsequent create, resolve, close, or update request to ServiceNow.

setSituationFlag

Sets a flag for a Situation.

setSituationServices

Sets the impacted services for a Situation.

setSituationState

Sets the state of the Situation. Not to be confused with Situation status. Sweep up filter applies.

setSlackTarget

Sets the target Slack channel and title for a message payload.

sigActionFilter

Returns true if the Situation action is of the specified type.

sigActionToolFilter

Returns true if the specified tool has been run against a Situation.

simpleLookup

Defines the lookup as two arrays of equal length. Sweep up filter applies.

situationDelta

Returns true when attributes have changed.

skip

Forwards an in-scope event, alert or Situation to the next chained moolet using the standard forwarding mechanism, and skips the rest of the workflows in the current engine.

sortList

Sorts a JavaScript array (a list) using the standard Array.sort() function.

staticLookup

Searches for a key in a static lookup table, retrieves the corresponding value, and applies that value to a field in the object.

stop

Stops the workflow.

substringValue

Substrings a value to the specified limit (or the closest preceding whitespace), then copies the result to either the optional destination field, or overwrites the source field.

testSendEmail

Specifies an email server instance as defined in the integrations UI.

updateServiceNowIncident

Sends an incident update request to ServiceNow.

upperCase

Changes the value of a field to uppercase. Sweep up filter applies.

workflowContextSearchAndReplace

Works only on fields within the workflowContext. The extracted fields are copied into a fixed workflowContext location: workflowContext.extract.

The following functions are available in specific infrastructure and automation workflows:

Function

Description

getJDBCEnrichment

Adds data to alerts from a JDBC database. Available in JDBC Enrichment workflows.

getServiceNowEnrichment

Adds data to alerts from a ServiceNow database.

processMicroFocusOOAutomationResponse

Processes the response from Micro Focus Operations Orchestration automation.

sendMicroFocusOOAutomationRequest

Sends a request to Micro Focus Operations Orchestration to launch a flow.

sendRequestToAutomation

Sends a request to the corresponding outbound automation workflow to invoke specified action for the named service.

sendToAnsible

Sends an automation request to Ansible. Available in Ansible Alert and Ansible Situation workflows.

sendToAutomation

Sends an automation request. Available in EyeShare Alert, EyeShare Situation, Ignio Alert, and Ignio Situation workflows.

sendToPuppet

Sends an automation request to Puppet. Available in Puppet Alert and Puppet Situation workflows.

setAnsibleJob

Sets the instance and job template rule to use for Ansible automation requests. Available in Ansible Alert and Ansible Situation workflows.

setAutomationPayload

Sets the automation solution, instance and Workflow Payload rule set to use for automation requests. Available in EyeShare Alert, EyeShare Situation, Ignio Alert, and Ignio Situation workflows.

setPuppetAutomation

Sets the instance and job template rule to use for Puppet automation requests. Available in Puppet Alert and Puppet Situation workflows.

The following functions are available in specific ticketing workflows:

Function

Description

closeAlertOpsIncident

Resolves the corresponding AlertOps alert.

closeIncident

Sends a request to the corresponding outbound integration workflow to close an incident for the named service.

createAlertOpsIncident

Creates a new AlertOps alert for a Situation.

createIncident

Sends a request to the corresponding outbound integration workflow to create a new incident for the named service.

receiveUpdateFromAlertOpsIncident

Updates Situations with responses from AlertOps.

resolveIncident

Sends a request to the corresponding outbound integration workflow to resolve an incident for the named service.

sendAcknowledgedToIncident

Sends a request to the corresponding outbound integration workflow to acknowledge an incident for the named service.

sendAssignedToAlertOpsIncident

Assigns the corresponding AlertOps alert to a user corresponding to the Situation moderator.

sendAssignedToIncident

Sends a request to the corresponding outbound integration workflow to assign the incident for the named service.

sendCIsAddedToIncident

Sends a request to the corresponding outbound integration workflow to add a list of CIs to the incident for the named service.

sendNoteToIncident

Sends a request to the corresponding outbound integration workflow to post a message to the incident for the named service.

sendTeamsAddedToAlertOpsIncident

Adds "recipients" to the corresponding AlertOps alert for teams added to a Situation.

sendTeamsAddedToIncident

Sends a request to the corresponding outbound integration workflow to add a list of teams to the incident for the named service.

sendTeamsRemovedToIncident

Sends a request to the corresponding outbound integration workflow to remove a list of teams from the incident for the named service.

sendThreadEntryToAlertOpsIncident

Sends a reply to the corresponding AlertOps alert.

sendThreadEntryToIncident

Sends a request to the corresponding outbound integration workflow to update the incident for the named service using thread entry retrieved by a preceding getThreadEntry action.

updateAlertOpsIncident

Sends generic updates to the AlertOps alert.

updateIncident

Sends a request to the corresponding outbound integration workflow to perform a generic update to an incident for the named service.