Skip to content

Commit

Permalink
Merge branch 'refs/heads/main' into feat-incidents-preset
Browse files Browse the repository at this point in the history
# Conflicts:
#	keep/api/consts.py
#	keep/api/core/db.py
  • Loading branch information
35C4n0r committed Sep 9, 2024
2 parents e0a731c + b6c186f commit 78652ca
Show file tree
Hide file tree
Showing 68 changed files with 2,174 additions and 1,209 deletions.
189 changes: 88 additions & 101 deletions docs/mint.json
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,11 @@
"url": "https://platform.keephq.dev/"
}
],
"analytics": {
"posthog": {
"apiKey": "phc_mYqciA4RO5g48K6KnmZtftn5xQa5625Aao7vsVC0gJ9"
}
},
"anchors": [],
"navigation": [
{
Expand All @@ -45,10 +50,7 @@
},
{
"group": "Development",
"pages": [
"development/getting-started",
"development/external-url"
]
"pages": ["development/getting-started", "development/external-url"]
},
{
"group": "Deployment",
Expand Down Expand Up @@ -80,7 +82,8 @@
"platform/alertseverityandstatus",
"platform/workflows",
"platform/settings",
"platform/metrics"
"platform/metrics",
"platform/support"
]
},
{
Expand All @@ -94,78 +97,78 @@
{
"group": "Supported Providers",
"pages": [
"providers/documentation/aks-provider",
"providers/documentation/appdynamics-provider",
"providers/documentation/axiom-provider",
"providers/documentation/azuremonitoring-provider",
"providers/documentation/centreon-provider",
"providers/documentation/cloudwatch-provider",
"providers/documentation/console-provider",
"providers/documentation/coralogix-provider",
"providers/documentation/datadog-provider",
"providers/documentation/discord-provider",
"providers/documentation/elastic-provider",
"providers/documentation/gcpmonitoring-provider",
"providers/documentation/github_workflows_provider",
"providers/documentation/gitlab-provider",
"providers/documentation/gitlabpipelines-provider",
"providers/documentation/google_chat-provider",
"providers/documentation/grafana-provider",
"providers/documentation/grafana_incident-provider",
"providers/documentation/grafana_oncall-provider",
"providers/documentation/http-provider",
"providers/documentation/ilert-provider",
"providers/documentation/incidentio-provider",
"providers/documentation/incidentmanager-provider",
"providers/documentation/jira-provider",
"providers/documentation/kibana-provider",
"providers/documentation/kubernetes-provider",
"providers/documentation/linear_provider",
"providers/documentation/linearb-provider",
"providers/documentation/mailchimp-provider",
"providers/documentation/mattermost-provider",
"providers/documentation/microsoft-planner-provider",
"providers/documentation/mock-provider",
"providers/documentation/mongodb-provider",
"providers/documentation/mysql-provider",
"providers/documentation/netdata-provider",
"providers/documentation/new-relic-provider",
"providers/documentation/ntfy-provider",
"providers/documentation/openobserve-provider",
"providers/documentation/openshift-provider",
"providers/documentation/opsgenie-provider",
"providers/documentation/pagerduty-provider",
"providers/documentation/pagertree-provider",
"providers/documentation/pingdom-provider",
"providers/documentation/planner-provider",
"providers/documentation/postgresql-provider",
"providers/documentation/pushover-provider",
"providers/documentation/quickchart-provider",
"providers/documentation/redmine-provider",
"providers/documentation/resend-provider",
"providers/documentation/rollbar-provider",
"providers/documentation/sendgrid-provider",
"providers/documentation/sentry-provider",
"providers/documentation/signalfx-provider",
"providers/documentation/signl4-provider",
"providers/documentation/site24x7-provider",
"providers/documentation/slack-provider",
"providers/documentation/snowflake-provider",
"providers/documentation/splunk-provider",
"providers/documentation/squadcast-provider",
"providers/documentation/ssh-provider",
"providers/documentation/statuscake-provider",
"providers/documentation/teams-provider",
"providers/documentation/telegram-provider",
"providers/documentation/template",
"providers/documentation/trello-provider",
"providers/documentation/twilio-provider",
"providers/documentation/uptimekuma-provider",
"providers/documentation/victoriametrics-provider",
"providers/documentation/webhook-provider",
"providers/documentation/websocket-provider",
"providers/documentation/zabbix-provider",
"providers/documentation/zenduty-provider"
"providers/documentation/aks-provider",
"providers/documentation/appdynamics-provider",
"providers/documentation/axiom-provider",
"providers/documentation/azuremonitoring-provider",
"providers/documentation/centreon-provider",
"providers/documentation/cloudwatch-provider",
"providers/documentation/console-provider",
"providers/documentation/coralogix-provider",
"providers/documentation/datadog-provider",
"providers/documentation/discord-provider",
"providers/documentation/elastic-provider",
"providers/documentation/gcpmonitoring-provider",
"providers/documentation/github_workflows_provider",
"providers/documentation/gitlab-provider",
"providers/documentation/gitlabpipelines-provider",
"providers/documentation/google_chat-provider",
"providers/documentation/grafana-provider",
"providers/documentation/grafana_incident-provider",
"providers/documentation/grafana_oncall-provider",
"providers/documentation/http-provider",
"providers/documentation/ilert-provider",
"providers/documentation/incidentio-provider",
"providers/documentation/incidentmanager-provider",
"providers/documentation/jira-provider",
"providers/documentation/kibana-provider",
"providers/documentation/kubernetes-provider",
"providers/documentation/linear_provider",
"providers/documentation/linearb-provider",
"providers/documentation/mailchimp-provider",
"providers/documentation/mattermost-provider",
"providers/documentation/microsoft-planner-provider",
"providers/documentation/mock-provider",
"providers/documentation/mongodb-provider",
"providers/documentation/mysql-provider",
"providers/documentation/netdata-provider",
"providers/documentation/new-relic-provider",
"providers/documentation/ntfy-provider",
"providers/documentation/openobserve-provider",
"providers/documentation/openshift-provider",
"providers/documentation/opsgenie-provider",
"providers/documentation/pagerduty-provider",
"providers/documentation/pagertree-provider",
"providers/documentation/pingdom-provider",
"providers/documentation/planner-provider",
"providers/documentation/postgresql-provider",
"providers/documentation/pushover-provider",
"providers/documentation/quickchart-provider",
"providers/documentation/redmine-provider",
"providers/documentation/resend-provider",
"providers/documentation/rollbar-provider",
"providers/documentation/sendgrid-provider",
"providers/documentation/sentry-provider",
"providers/documentation/signalfx-provider",
"providers/documentation/signl4-provider",
"providers/documentation/site24x7-provider",
"providers/documentation/slack-provider",
"providers/documentation/snowflake-provider",
"providers/documentation/splunk-provider",
"providers/documentation/squadcast-provider",
"providers/documentation/ssh-provider",
"providers/documentation/statuscake-provider",
"providers/documentation/teams-provider",
"providers/documentation/telegram-provider",
"providers/documentation/template",
"providers/documentation/trello-provider",
"providers/documentation/twilio-provider",
"providers/documentation/uptimekuma-provider",
"providers/documentation/victoriametrics-provider",
"providers/documentation/webhook-provider",
"providers/documentation/websocket-provider",
"providers/documentation/zabbix-provider",
"providers/documentation/zenduty-provider"
]
}
]
Expand Down Expand Up @@ -266,15 +269,11 @@
},
{
"group": "healthcheck",
"pages": [
"api-ref/healthcheck/healthcheck"
]
"pages": ["api-ref/healthcheck/healthcheck"]
},
{
"group": "topology",
"pages": [
"api-ref/topology/get-topology-data"
]
"pages": ["api-ref/topology/get-topology-data"]
},
{
"group": "alerts",
Expand Down Expand Up @@ -348,21 +347,15 @@
},
{
"group": "whoami",
"pages": [
"api-ref/whoami/get-tenant-id"
]
"pages": ["api-ref/whoami/get-tenant-id"]
},
{
"group": "pusher",
"pages": [
"api-ref/pusher/pusher-authentication"
]
"pages": ["api-ref/pusher/pusher-authentication"]
},
{
"group": "status",
"pages": [
"api-ref/status/status"
]
"pages": ["api-ref/status/status"]
},
{
"group": "rules",
Expand Down Expand Up @@ -420,9 +413,7 @@
},
{
"group": "metrics",
"pages": [
"api-ref/metrics/get-metrics"
]
"pages": ["api-ref/metrics/get-metrics"]
},
{
"group": "users",
Expand All @@ -435,9 +426,7 @@
},
{
"group": "groups",
"pages": [
"api-ref/groups/get-groups"
]
"pages": ["api-ref/groups/get-groups"]
},
{
"group": "mappings",
Expand All @@ -458,9 +447,7 @@
},
{
"group": "tags",
"pages": [
"api-ref/tags/get-tags"
]
"pages": ["api-ref/tags/get-tags"]
}
]
},
Expand Down
26 changes: 19 additions & 7 deletions docs/overview/enrichment/mapping.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -4,28 +4,40 @@ title: "Mapping"

# Alert Enrichment: Mapping

Keep's Alert Mapping enrichment feature provides a powerful mechanism for dynamically enhancing alert data by leveraging external data sources, such as CSV files. This feature allows for the matching of incoming alerts to specific records in a CSV file based on predefined attributes (matchers) and enriching those alerts with additional information from the matched records.
Keep's Alert Mapping enrichment feature provides a powerful mechanism for dynamically enhancing alert data by leveraging external data sources, such as CSV files and topology data. This feature allows for the matching of incoming alerts to specific records in a CSV file or topology data based on predefined attributes (matchers) and enriching those alerts with additional information from the matched records.

## Introduction

In complex monitoring environments, the need to enrich alert data with additional context is critical for effective alert analysis and response. Keep's Alert Mapping and Enrichment enables users to define rules that match alerts to rows in a CSV file, appending or modifying alert attributes with the values from matching rows. This process adds significant value to each alert, providing deeper insights and enabling more precise and informed decision-making.
In complex monitoring environments, the need to enrich alert data with additional context is critical for effective alert analysis and response. Keep's Alert Mapping and Enrichment enables users to define rules that match alerts to rows in a CSV file or topology data, appending or modifying alert attributes with the values from matching rows. This process adds significant value to each alert, providing deeper insights and enabling more precise and informed decision-making.

## How It Works

## Mapping with CSV Files

1. **Rule Definition**: Users define mapping rules that specify which alert attributes (matchers) should be used for matching alerts to rows in a CSV file.
2. **CSV File Specification**: A CSV file is associated with each mapping rule. This file contains additional data that should be added to alerts matching the rule.
3. **Alert Matching**: When an alert is received, the system checks if it matches the conditions of any mapping rule based on the specified matchers.
4. **Data Enrichment**: If a match is found, the alert is enriched with additional data from the corresponding row in the CSV file.

## Mapping with Topology Data

1. **Rule Definition**: Users define mapping rules that specify which alert attributes (matchers) should be used for matching alerts to topology data.
2. **Topology Data Specification**: Topology data is associated with each mapping rule. This data contains additional information about the components and their relationships in your environment.
3. **Alert Matching**: When an alert is received, the system checks if it matches the conditions of any mapping rule based on the specified matchers.
4. **Data Enrichment**: If a match is found, the alert is enriched with additional data from the corresponding topology data.

## Practical Example

Imagine you have a CSV file with columns representing different aspects of your infrastructure, such as `region`, `responsible_team`, and `severity_override`. By creating a mapping rule that matches alerts based on `service` and `region`, you can automatically enrich alerts with the responsible team and adjust severity based on the matched row in the CSV file.

Similarly, you can use topology data to enrich alerts. For example, if an alert is related to a specific service, you can use topology data to find related components and their statuses, providing a more comprehensive view of the issue.

## Core Concepts

- **Matchers**: Attributes within the alert used to identify matching rows within the CSV file. Common matchers include identifiers like `service` or `region`.
- **Matchers**: Attributes within the alert used to identify matching rows within the CSV file or topology data. Common matchers include identifiers like `service` or `region`.
- **CSV File**: A structured file containing rows of data. Each column represents a potential attribute that can be added to an alert.
- **Enrichment**: The process of adding new attributes or modifying existing ones in an alert based on the data from a matching CSV row.
- **Topology Data**: Information about the components and their relationships in your environment. This data can be used to enrich alerts with additional context.
- **Enrichment**: The process of adding new attributes or modifying existing ones in an alert based on the data from a matching CSV row or topology data.

## Creating a Mapping Rule

Expand All @@ -35,13 +47,13 @@ To create an alert mapping and enrichment rule:
<img height="10" src="/images/rule-creation.png" />
</Frame>

1. **Define the Matchers**: Specify which alert attributes will be used to match rows in the CSV file.
2. **Upload the CSV File**: Provide the CSV file containing the data for enrichment.
1. **Define the Matchers**: Specify which alert attributes will be used to match rows in the CSV file or topology data.
2. **Specify the Data Source**: Provide the CSV file or specify the topology data to be used for enrichment.
3. **Configure the Rule**: Set additional parameters, such as whether the rule should override existing alert attributes.

## Best Practices

- **Keep CSV Files Updated**: Regularly update the CSV files to reflect the current state of your infrastructure and operational data.
- **Keep CSV Files and Topology Data Updated**: Regularly update the CSV files and topology data to reflect the current state of your infrastructure and operational data.
- **Use Specific Matchers**: Define matchers that are unique and relevant to ensure accurate matching.
- **Monitor Rule Performance**: Review the application of mapping rules to ensure they are working as expected and adjust them as necessary.

Expand Down
16 changes: 16 additions & 0 deletions docs/platform/support.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
title: "Support"
sidebarTitle: Support
---

## Overview
You can use the following methods to ask for support/help with anything related with Keep:

<CardGroup cols={2}>
<Card title="Slack Community" icon="square-1">
You can use the [Keep Slack community](https://slack.keephq.dev) to get support.
</Card>
<Card title="Email" icon="square-2">
You can use [email protected] to send inquiries.
</Card>
</CardGroup>
13 changes: 13 additions & 0 deletions docs/providers/documentation/victoriametrics-provider.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,19 @@ The Victoriametrics provider requires the following authentication parameters:
1. Ensure you have a running instance of VMAlert accessible by the host and port specified.
2. Include the host and port information in your Victoriametrics provider configuration when initializing the provider.

## Querying Victoriametrics

The Victoriametrics provider allows you to query from Victoriametrics through `query` and `query_range` types. The following are the parameters available for querying:

1. `query` type:
- `query`: The query to execute on Victoriametrics. Example: `sum(rate(http_requests_total{job="api-server"}[5m]))`.
- `start`: The time to query the data for. Example: `2024-01-01T00:00:00Z`

2. `query_range` type:
- `query`: The query to execute on Victoriametrics. Example: `sum(rate(http_requests_total{job="api-server"}[5m]))`.
- `start`: The start time to query the data for. Example: `2024-01-01T00:00:00Z`
- `end`: The end time to query the data for. Example: `2024-01-01T00:00:00Z`
- `step`: The step size to use for the query. Example: `15s`

## Push alerts to keep using webhooks

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@
auth_domain = os.environ.get("AUTH0_DOMAIN")
if auth_domain:
jwks_uri = f"https://{auth_domain}/.well-known/jwks.json"
jwks_client = jwt.PyJWKClient(jwks_uri, cache_keys=True)
jwks_client = jwt.PyJWKClient(
jwks_uri, cache_keys=True, headers={"User-Agent": "keep-api"}
)
else:
jwks_client = None

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@ def __init__(self, tenant_id, context_manager: ContextManager, **kwargs):
self.client_secret = os.environ.get("AUTH0_CLIENT_SECRET")
self.audience = f"https://{self.domain}/api/v2/"
self.jwks_client = jwt.PyJWKClient(
f"https://{self.domain}/.well-known/jwks.json", cache_keys=True
f"https://{self.domain}/.well-known/jwks.json",
cache_keys=True,
headers={"User-Agent": "keep-api"},
)

def get_users(self) -> list[User]:
Expand Down
15 changes: 15 additions & 0 deletions examples/workflows/query_victoriametrics.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
workflow:
id: query-victoriametrics
name: victoriametrics
description: victoriametrics
triggers:
- type: manual
steps:
- name: victoriametrics-step
provider:
config: "{{ providers.victoriametrics }}"
type: victoriametrics
with:
query: process_memory_limit_bytes
queryType: query
actions: []
Loading

0 comments on commit 78652ca

Please sign in to comment.