Automatic discovery of recipients/groups

Question

We have begun implementing a tagging standard in our cloud accounts to better control discovered resources and route alerts accordingly. I would like to be able to route alerts by default based on the value of a tag. I'm aware that I can already set up specific users and then achieve exactly what I'm requesting, but I would much prefer to have a blanket rule that uses the tag's value as the recipient email address(es) directly. Some examples below:

system.aws.tag.MonitorAlertEmail=ThisIsAnExample@PleaseOfferThisFeature.com

system.aws.tag.SendAlertsHere=AnotherExcellentExample@WeWillPayExtraForThisFunctionality.gov AnotherEmailAddress@OkayNotReally.net

See the screenshots below for a visual example of how I'd like to structure this automation.

system.aws.tag.MonitorAlertEmail=ThisIsAnExample@PleaseOfferThisFeature.com

system.aws.tag.SendAlertsHere=AnotherExcellentExample@WeWillPayExtraForThisFunctionality.gov AnotherEmailAddress@OkayNotReally.net

See the screenshots below for a visual example of how I'd like to structure this automation.

&nbsp;

krishnasingh · Answer

Hi Brandon,

I think LogicMonitor does not have feature to send notification based on AWS tag like owner name etc. but it can discover it. You can create small solution using AWS API Gateway, Lambda and SES. I have done it for testing purpose and was working fine.

Flow would be:

Alert Rule --&gt;Escalation Chain --&gt;HTTP JSON integration (POST) --&gt;&nbsp;AWS API getaway --&gt;&nbsp;Lambda function (python or Node.js) --&gt; SES services.

Below is simple python code for this.

Quote

import json
			import boto3
			import re&nbsp;
			from botocore.exceptions import ClientError

def lambda_handler(event, context):

&nbsp; &nbsp; &nbsp; &nbsp; # Replace sender@example.com with your "From" address.
			&nbsp; &nbsp; &nbsp; &nbsp; # This address must be verified with Amazon SES.
			&nbsp; &nbsp; &nbsp; &nbsp; SENDER = "sender@yourcompany.com"
			&nbsp; &nbsp; &nbsp; &nbsp; # Make a regular expression&nbsp;
			&nbsp; &nbsp; &nbsp; &nbsp; # For validating an Email&nbsp;
			&nbsp; &nbsp; &nbsp; &nbsp; regex = '^[a-z0-9]+[\._]?[a-z0-9]+[@]\w+[.]\w{2,3}$'
			&nbsp; &nbsp; &nbsp; &nbsp; # Replace recipient@example.com with a "To" address. If your account&nbsp;
			&nbsp; &nbsp; &nbsp; &nbsp; # is still in the sandbox, this address must be verified.
			&nbsp; &nbsp; &nbsp; &nbsp; if(re.search(regex,event['recipient'].strip())):
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RECIPIENT = event['recipient']
			&nbsp; &nbsp; &nbsp; &nbsp; else:
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RECIPIENT="defaultemail@yourcompany.com &gt;"
			&nbsp; &nbsp; &nbsp; &nbsp;
			&nbsp; &nbsp; &nbsp; &nbsp; AWS_REGION = "ap-south-1"
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# The subject line for the email.
			&nbsp; &nbsp; &nbsp; &nbsp; SUBJECT = "LogicMonitor " + event['level'] + " " + event['hostname']&nbsp;
			&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
			&nbsp; &nbsp; &nbsp; &nbsp; # The email body for recipients with non-HTML email clients.
			&nbsp; &nbsp; &nbsp; &nbsp; BODY_TEXT = ("LogicMonitor Genrated Mail
"
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"This email was sent for threshold breach "
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"on your system."
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
			&nbsp; &nbsp; &nbsp; &nbsp; # The HTML body of the email.
			&nbsp; &nbsp; &nbsp; &nbsp; BODY_HTML = """&lt;html&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &lt;head&gt;&lt;/head&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &lt;body&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;h1&gt;LogicMonitor Alert&lt;/h1&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;p&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;table style="width:100%"&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;tr&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;td&gt;Hostname&lt;/td&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;td&gt;"""+event['hostname']+"""&lt;/td&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/tr&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;tr&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;td&gt;Alert Message&lt;/td&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;td&gt;"""+event['message']+"""&lt;/td&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/tr&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;tr&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;td&gt;Start Time&lt;/td&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;td&gt;"""+event['start']+"""&lt;/td&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/tr&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/table&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/p&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &lt;/body&gt;
			&nbsp; &nbsp; &nbsp; &nbsp; &lt;/html&gt;

&nbsp;

LogicMonitor HTTP integration screenshot&nbsp;

&nbsp;

Forum Discussion

Automatic discovery of recipients/groups

1 Reply

Related Content

Azure Backup Job DS Discovery

Excluding VMware VMs from instance discovery

Automatic removal of category

Instance discovery time

CW Integration and Recipient Group Alert Routing

Recent Discussions

Topology Mapping - Edge connection alert status

Topology Mapping - Include connection details on map

Issue with group-level thresholds in UIv4

Needed Features for Network Topology Mapping

Dependent Alert Mapping - reviewing cleared alerts