Hello all,
After many years as an Orion/SWOSH admin I've dropped headfirst into the SaaS world and am trying to create like for like when it comes to host metric alerts, which may not be the IDEAL way of going about it but users hate receiving a JSON payload in a text email :)
In SWOSH you have SWQL statements and built-in macros for things like hostname, alert time, alert name etc. Nicely formatted text or HTML emails. For SaaS these are Parameters, things like
{{icon}}, {{severity}}, {{priority}}
These are fine, I can put these in emails and they resolve to the correct info. A more difficult thing seems to be Entities for anomaly alerts because they are blocks like:
{{#entities}}
{
"name": "{{displayName}}",
"timestamp": "{{timestamp}}",
"entityUrl": "{{{entityUrl}}}"
}
{{^last}},{{/last}}
{{/entities}}
Documentation on these seems to be non-existent because it's assumed you're notifying another service like Teams, Slack, SNOW etc via a JSON payload.
Anyone dipped their toes into this yet?