Edwin AI Rules

In Edwin AI, rules automate system responses to changes in data. A rule follows a simple if-then structure: If data changes in a certain way, then Edwin AI triggers a set of actions. Each rule is tied to the action group which defines the sequence of actions that run when the rule conditions are met. Edwin AI provides a set of default rules you can use as-is or customize. These rules appear in the interface with descriptions and are designed to match the typical incident lifecycle process.

Rules and action groups work together to define what happens with a record when it is ingested, deduplicated, and correlated within Edwin.

Each rule includes the following:

• Action group—The set of actions that run when the rule is triggered.
• Record type—Inherited from the selected action group.
• Rule type—Either automatic or interactive and is determined by the action group that is selected.
• Mandatory filter—Defines the condition that triggers the rule.

Each action group includes the following:

• Record type—This can be an event.
• Sequence of actions—Steps performed when the rule runs.

There are two types of rules in Edwin AI, depending on how they are triggered: Automatic and Interactive. The rule type is determined by the associated action group. An action group can include only one type of rule.

Automatic Rules

Automatic rules run without input. They trigger when Edwin AI processes the following types of data:

• Event records from integrations.
• ML observations from machine learning when correlations are created.
• sncIncident records from ServiceNow CMDB. 
• sncCmdb records from ServiceNow integrations. 

Examples of Automatic rules include the following:

• Creating a new alert automatically when a new event is detected.
• Updating an existing alert record when a duplicate event is detected.

Interactive Rules

Interactive rules expose available actions to users through the user interface when conditions are met as defined by the rule. They are typically used with the following record types:

• Alert records
• Insight records

An example of an interactive rule is when users can trigger an  Assign to me  action from the dashboard if an alert state is not closed.

Requirements for Creating Edwin AI Rules

1. In LogicMonitor, navigate to Edwin AI > Rules. 
2. Select Create Rule.
   
3. Configure the following settings:
   1. In the Name field, add a descriptive name for the rule. For example, Create Incident. 
   2. In the Description field, provide a description explaining what the rule does.
   3. Select the action group you want associated with the rule by doing one of the following:
      
      • To create a rule with an automatic action, select Add Automatic Action, and do one of the following: 
        • To create and update insights in ServiceNow, based on the outcome of machine learning events, select Alert Correlation.
        • To process incoming events and create and update alerts and associated incidents in ServiceNow, select LM Alert Processing. 
        • To store enrichment data for configuration items, select CMDB Processing. 
        • To store enrichment data for LogicMonitor events (alerts), select LM Enrichment Processing.
        • To update incident details for alerts and insights in ServiceNow, select Incident Processing. 
          

          Note: These rules are the default automatic rules. If you create your own automatic rule, it will also display in this list.

      • To create a rule with an interactive action, select Add Interactive Action, and do one of the following:
        • Create GenAI Summary—Creates and enriches Insight with GenAI title, summary, and root cause analysis.
          

          Note: The Create GenAI Summary rule is only an option if you have purchased GenAI. 

        • Assign Insight—Manually assigns an insight from Edwin AI.
        • Create Incident (Insight)—Creates an insight-based incident in ServiceNow.
        • Assign Alert—Manually assigns an alert from Edwin AI.
        • Close Insight—Manually closes an insight from Edwin AI.
        • Create Incident (Alert)—Creates an alert-based incident in ServiceNow.
          

          Note: These rules are the default Interactive rules. If you create your own interactive rule, it will also display in this list.

   4. (Optional) To immediately enable your rule, toggle the Enabled switch.
      You can leave the rule disabled and manually enable it from your rules page.
   5. (Optional) Select Parameters to add variables that pass specific information from the associated action group.
4. Select Submit to create rule.