From Event to Incident
As explained in ::title, when an event is retrieved by Resolve Actions:
- The incoming event arrives at the parsing/mapping checkpoint, where it is determined whether the event qualifies as an incident or is handled as a basic event.
- The event/incident is checked by the Workflow Trigger, and if certain conditions apply, the event (or incident) invokes a workflow. note
In case of an incident, such conditions may refer to variables that were produced during the parsing/mapping procedure.
- Regardless of workflow execution, if an Incident was created, it is displayed in the Actions LIVE dashboard.