Edwin AI ThousandEyes Integration

The LogicMonitor Edwin AI ThousandEyes Integration enables Edwin AI to receive alert events from your ThousandEyes environment in real time using custom webhooks. This facilitates automated response, alert enrichment, and cross-platform incident correlation.

This integration supports structured JSON payloads using the Edwin Common Event Format (CEF) and can be configured to enrich event data with test metrics, rule metadata, and more.

Setting up the Edwin AI ThousandEyes integration involves the following:

1. Installing and configuring a custom webhook integration in ThousandEyes
2. Assigning webhooks to alert rules
3. Using enrichments in webhook payload for custom data

All setup actions are explicitly required, and Edwin AI cannot process data until configurations are completed.

Requirements for Configuring Edwin AI ThousandEyes Integration

To configure your Edwin AI ThousandEyes Integration, you need the following:

• Access to the Integrations page in your ThousandEyes account
• An Edwin AI Client ID and Client Secret, provided by your Edwin AI administrator

Installing and Configuring the Webhook Integration in ThousandEyes

1. In ThousandEyes, navigate to Integrations > New Integration.
2. Select Custom Webhook, from the Integration Type. 
3. Select “OAuth Client Credentials”from the Auth Type dropdown menu. 
4. Configure the OAuth2.0 Authentication by doing the following:
   1. In the Name field, enter “Edwin AI”
   2. In the URL field, enter the following URL: “https://<accountname>.dexda.ai/integration/event/v1"
   3. In the Token URL field, enter the following URL: “https://<accountname>.dexda.ai/auth/token"
   4. In the Client ID field, enter the following: “<client_id>.”
   5. In the Client Secret field, enter the following: “<client_secret>.”
5. In the Body field of the integration, enter the following Edwin CEF-formatted JSON payload: 
   

   [
       {
           "cef" : {
               {{#if alert.targets.size}}
                   "eventCi": "{{#each alert.targets}}{{description}}{{#unless @last}}, {{/unless}}{{/each}}",
               {{else}}
                   "eventCi" : "",
               {{/if}}
               "eventObject" : "{{alert.test.name}}",
               "eventName" : "{{alert.rule.name}}",
               "eventDescription" : "{{formatExpression alert.rule.expression}}",
               {{#if alert.details.size}}
                   "eventDetails": "{{#each alert.details}}{{source.name}}: {{metricsAtStart}} - {{metricsAtEnd}} {{#unless @last}}, {{/unless}}{{/each}}",
               {{else}}
                   "eventDetails" : "",
               {{/if}}
               {{#if (eq type.id 1)}}
                   "eventSeverity": 0,
               {{else}}
                   {{#if (eq alert.severity.id "INFO")}}
                       "eventSeverity": 1,
                   {{/if}}
                   {{#if (eq alert.severity.id "MINOR")}}
                       "eventSeverity": 2,
                   {{/if}}
                   {{#if (eq alert.severity.id "MAJOR")}}
                       "eventSeverity": 3,
                   {{/if}}
                   {{#if (eq alert.severity.id "CRITICAL")}}
                       "eventSeverity": 4,
                   {{/if}}
               {{/if}}
               "eventId": "{{id}}",
               "eventTimestamp" : {{alert.firstSeen.epochMilli}},
               "eventSourceIdLink": "https://app.thousandeyes.com/alerts/list/?__a={{alert.rule.account.id}}&alertId={{alert.id}}",
               "eventSourceId" : "{{alert.id}}",
               "eventSource": "ThousandEyes",
               "sourceRecord": {},
               "class": "event",
               "version": "1.1",
               "eventDomain" : ""
           },
           "enrichments": {} 
       }
   ]

   Copy
   
   This payload dynamically maps ThousandEyes alert data to the Edwin AI CEF structure.
   For more information, see Event Records. 

Assigning Webhooks to Alert Rules

1. In ThousandEyes, navigate to Manage > Integrations.
2. Select your Edwin AI Webhook, then select Manage Alert Rules from the ellipsis dropdown menu. 
3. Select an existing rule or create a new one. For more information, see Creating and Editing Alert Rules from ThousandEyes.
4. Select Save. 
   For more information, see Attaching Alert Rules to Your Webhook from ThousandEyes.

Using Enrichments in Webhook Payload

You can use templating logic and enrichments in the JSON payload to control behavior and surface contextual data in Edwin AI. These enrichment fields will display in the Edwin AI interface and can be used to automate triage, assignment, or correlation.

The following JSON snippet illustrates how the enrichment displays in the payload:

"enrichments": {
  "test_id": "{{alert.test.id}}",
  "test_type": "{{alert.test.type}}",
  "assignment_group": "network_support"
}