Application/Activity/Location

Execute this runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. when an application An entity type representing software applications deployed in the customer environment that are monitored for performance and anomalies. shows possible degradation in performance in the context of activity and location An entity type representing physical or logical locations in the customer environment where entities are deployed and monitored.. This trigger ties the application to a specific location and activity context.

Analytics, indicators, and incidents

When Activity Response Time for an application activity at a location is anomalous, the analytics pipeline produces indicators An observed change in a specific metric stream that is recognized as being outside of an expected model. Indicators are correlated into triggers, and one or more triggers are grouped into incidents. for that application-activity-location object. The platform correlates those indicators into a detection One or more indicators that are correlated and may act as a trigger for incident creation or runbook execution., which can surface as a new incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. whose automation starts with this Application/Activity/Location trigger. You enable or tune the policy on the Analytics & Threshold Configuration page (see Analytics configuration sections, Application activities). For how indicators relate to incidents, see Ingest & Analytics: Indicators.

Map this trigger to a runbook on the Automation Management page, the same way as other new-incident triggers. You can open the mapped runbook in the Runbook Editor to create or edit the investigation flow.