Built-In Variables

Variables enable you to query for and manipulate specific information in various nodesClosed Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. throughout a runbookClosed An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook., such as HTTP Request, Decision Branch, and Data Ocean Query. Built-in variables are variables that are included within the runbook and cannot be edited or removed.

In the variable definition editor, built-In variables are organized in two tabs: runtime scope and incidentClosed A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. scope. Incident scope only appears in Lifecycle and Incident Runbooks.

The following variables are built in to Riverbed IQ Ops and are accessible in the Runbook Editor, provided as built-in Liquid templating language variables:

Runtime Scope

  • runtime.builtin.runbook.name

  • runtime.builtin.runbook.last_modified

  • runtime.builtin.runbook.modified_by

  • runtime.builtin.runbook.created_on

  • runtime.builtin.runbook.created_by

  • runtime.builtin.runbook.is_builtin

  • runtime.builtin.runbook.execution_id

  • runtime.builtin.runbook.reference_time

Incident Scope

  • incident.builtin.title

  • incident.builtin.creation_time

  • incident.builtin.priority

  • incident.builtin.status

  • incident.builtin.primary_indication.kind

  • incident.builtin.primary_indicatory.metric.name

  • incident.builtin.primary_indicator.metric.value

  • incident.builtin.primary_indicator.threshold.value

  • incident.builtin.primary_indicator.baseline.value

  • incident.builtin.primary_indicator.start

  • incident.builtin.primary_indicator.end

  • incident.builtin.primary_indicator.application.name

  • incident.builtin.primary_indicator.device.name

  • incident.builtin.primary_indicator.device.ipaddr

  • incident.builtin.primary_indicator.device.serial_number

  • incident.builtin.primary_indicator.device.os_version

  • incident.builtin.primary_indicator.device.model

  • incident.builtin.primary_indicator.device.type

  • incident.builtin.primary_indicator.device.vendor

  • incident.builtin.primary_indicator.device.is_gateway

  • incident.builtin.primary_indicator.interface.name

  • incident.builtin.primary_indicator.interface.ifindex

  • incident.builtin.primary_indicator.interface.ippaddr

  • incident.builtin.primary_indicator.interface.inbound_speed

  • incident.builtin.primary_indicator.interface.outbound_speed

  • incident.builtin.primary_indicator.interface.type

  • incident.builtin.primary_indicator.interface.ifalias

  • incident.builtin.primary_indicator.interface.ifdescr

  • incident.builtin.primary_indicator.interface.ifipaddrs

  • incident.builtin.primary_indicator.location.name

  • incident.builtin.primary_indicator.location.type

  • incident.builtin.primary_indicator.location.geo.city

  • incident.builtin.primary_indicator.location.geo.state

  • incident.builtin.primary_indicator.location.geo.country

  • incident.builtin.url