Configuring Store Enrichment Data Action

Processes in Dexda, manual or automatic, involve a set of actions to accomplish a goal. An action group is a sequence of individual actions that are executed in order. For more information about the concept of action groups, see About Action Groups. The Store Enrichment Data action described here is a pre-configured action used to maintain a local cache of enrichment data in Dexda.Describes how to set up the Store Enrichment Data action.

Caching Enrichment Data

During event processing, an event’s event.eventCI field is used to look up the enrichment cache index. If a match is found, the corresponding enrichment record is copied to the event. This provides an accurate record of the asset or CI at the time the event was processed. The record can contain for example its software version, which provides a valuable audit trail for analysis. Once an event has been enriched, its complete set of data is available throughout the application, from rules processing to dashboards.

Dexda’s enrichment cache is maintained in the following ways:

• Inbound Integrations. Dexda features a range of integrations to third-party platforms such as ServiceNow. You can configure these integrations to deliver scheduled batches or single item record updates to Dexda’s inbound integration service endpoint. Data arriving at this endpoints undergoes rules-based processing with matched rules triggering a specified action. To store CI or Asset data, you should configure the processing rule to call the Store Enrichment Data action. See Creating Rules.
• Update ServiceNow CI or Asset. When this action is called, if successful, the entire CI or asset record is returned in the response. This data can be used within an Action Group by calling the Store Enrichment Data action as a subsequent step. See Configuring Update ServiceNow CI or Asset Action.

In both instances, the configuration of the Store Enrichment Data action is identical.

Configuring a Store Enrichment Data Action

The following describes the configuration parameters and available options when creating action groups that involves the Store Enrichment Data action. For general information on how to work with action groups, see Creating Action Groups.

Settings Tab

Field	Description
Action	The action to run (Store Enrichment Data).
Only When	Only run the curent step if the following condition is met…??
Stop When	Stop the entire sequence if any of the following conditions are met…??
Stop If	Describes the conditions under which the Action Group flow should be stopped. Multiple conditions can be selected. – Enrichment data stored: the action successfully stored an enrichment record. – Enrichment data not stored: the action did not store an enrichment record. – Action Skipped: the action did not run because the filter was not matched to the input record. – Action Failed: the action failed to complete successfully.
Filter	Condition that describes whether the action should run.

Mappings Tab

Mappings are not supported for the Store Enrichment Data action.

Advanced Tab

Field	Description
KeyField	The field on the enrichment data that should be used to index data. This index is used to lookup the value of event.eventCI.
Prefix	A table prefix ensuring that columns that are common to multiple tables, for example name which is common to cmdb and asset), are stored using a unique table prefix.
ParentField ??	The field on the data record that contains a reference to a parent record. The reference should be resolvable through the same index used for KeyField.
LowercaseKeyValue	By default, the case of the KeyField’s will not be changed, and for a successful enrichment successful the event.eventCI must match a KeyField exactly. To make this matching cases insensitive, set this field to “true”. When enabled, the keyField value will be lowercased at the point of storage. Note: After enabling this setting you may need to resend all enrichment data from the source system in order for it to be re-indexed in lower case.
ParseIsoDateTime	Enabled by default. Disable if you prefer to store ISO date/time string values exactly as they are received.
ExternalRecordType	Specifies the type of the external record. This parameter is used by Dexda to unpack and process the record. If empty, the action will use the Source record for the action group. Note: If the Source record is not the same as the external record, this field must be set. This is the case for example when using this action as part of a complex flow where the source (input) record is an event. Supported record types are: sncCmdb
RelationshipsFilter	Describe…??
RelationshipsField	Describe…??
RelationshipsValue	Describe…??