Updating the Alerts Notes using API / Acknowledge

jlescano

Does anyone have a script or know which tables and columns are needed to query to update the notes on an active alert? 

We are working on a project to update active alerts with information from our ticketing system into the notes field.  

From what I have gathered, here are my findings

To update the alert note field I need to query the AlertactiveHistory table: query the table to find the alertobjectid using the AAT # (located in the URL) and alerthistoryid = timestamp (use latest date) 

Am I correct or is there another table I should be using or joining ? 

Seashore

Hi, this is a part of a script to do that and some more:

switch ($action) 
{
    ({$PSitem -eq "Ack"}) 
        { Invoke-SwisVerb $swis Orion.AlertActive Acknowledge @(@($TargetAlertID),"$TargetAlertNote") 
        Write-Log -Level Info -Message "Acknowledged alert id $TargetAlertID"}
    ({$PSitem -eq "UnAck"}) 
        {Invoke-SwisVerb $swis Orion.AlertActive UnAcknowledge @(@($TargetAlertID),"$TargetAlertNote")
        Write-Log -Level Info -Message "UnAcknowledged alert id $TargetAlertID"}
    ({$PSitem -eq "Note"})     
        {Invoke-SwisVerb $swis Orion.AlertActive AppendNote @(@($TargetAlertID),"$TargetAlertNote")
        Write-Log -Level Info -Message "Added Note for alert id $TargetAlertID"}
    Default 
        {
            Write-host "  Commandline: OrionAcks.ps1 action=xx TargetAlertID=nnn TargetAlertNote=yyy"
            Write-Host "  Where xx= Ack, UnAck or Note"
            Write-Host "  TargetAlertID= the Alert id to affect"
            Write-Host "  TargetAlertNote=Optional note to append to alert, does not ack alert"
        }   
}

So you see, "{Invoke-SwisVerb $swis Orion.AlertActive AppendNote @(@($TargetAlertID),"$TargetAlertNote") " can be used to add notes to alerts.