Configuring Policies to Setup Alerts
Overview
Alerts are triggered via policies when a specific event occurs in your infrastructure. The type of policies created and the threshold values mentioned while configuring the policies determine the conditions under which alerts are triggered.
Navigation
Go to Menu, Select Settings 
. After that, Go to Policy Settings 
. Select Metric/Log/Flow policy based on the type of policy you want to create. The list of the created policies is now displayed. Here, you can view all the different types of policies available in the system.
Policy List Actions
The following actions are available for every policy from the policy list, regardless of policy type:
| Action | Description |
|---|---|
| Edit | Opens the policy in edit mode so you can change its conditions, notification, or take action settings. |
| Delete | Removes the policy from the system. Alerts already generated by the policy remain in the alerts screen. |
| Clone | Creates a new policy by copying the source policy's configuration. Use it when you need a policy that only differs from an existing one in a few fields, such as monitor scope, threshold, severity, or notification profile. |
The cloned policy opens in edit mode with a default name of Copy of - <Original Policy Name>. If that name already exists, ObserveOps appends an incremental suffix such as Copy of - <Original Policy Name> (2). You can edit the name before saving. The cloned policy is saved as an independent policy. Changes to the source policy after cloning do not affect the clone, and system-generated values such as policy ID, creation timestamp, audit records, and alert history are not copied.
Configuration
In order to configure policies, you need to perform the following steps:
- Select the policy type, provide policy name & policy tags.
- Define the conditions for the alert to be triggered.
- Select the teams to notify when an alert is triggered.
- Define the actions to take when an alert is triggered.
The steps to configure policy will be discussed in detail for each Alert type in detail on the next page.
From the alerts screen, click on 
to start creating a policy. The screen to create policy is now displayed.
Select Policy Type
The Metric Policy is selected by default. Select the type of policy you want to create from the panel on the left of the screen. Once you select the policy type, the parameters to create the selected policy type appears on the screen.
Enter the Policy Name and Tag details to identify and categorise the policy for future reference.
Set Conditions
The alert conditions vary based on the monitor type. Configure monitors to trigger if the query value crosses a threshold, or if a certain number of consecutive checks failed.
Next, you need to set the conditions under which the alert will be triggered. The conditions and parameters for the policies vary based on the type of the policy selected. Configure the policies to trigger alerts whenever a specific entity crosses a threshold or in case some services are not available.
You can configure policies to trigger an alert when:
A specific metric is Greater Than, Greater Than or Equal to, Less Than, Less Than or Equal To, Not Equals ,Equals the threshold during the selected time period specified in the policy configuration.
A specific service or a monitor is not available.
Notification
While configuring a policy, you can decide the teams to notify when an alert is raised. You can set the email addresses, handle, username, or user profile of the relevant personnel to be notified.
You can configure a policy to notify the relevant team members whenever the polling gets failed for a monitor after an alert is raised.
You can configure a policy to notify the relevant team members whenever the flap(alert severity) changes.
You can configure a policy to send a customised notification if you do not wish to use the default message that is sent by ObserveOps.
You can add BCC recipients to an email alert notification. In the Notification section, the To field is visible by default. Select + Bcc at the end of the To field to open a BCC field below it. Any recipient you add to BCC receives the email through the BCC header and stays hidden from other recipients. Remove the BCC field to drop all BCC recipients from the policy. BCC applies to email notifications only.
The first recipient configured in the To field of the Notification section is placed in the email To header and is visible to every other recipient. Set this first recipient to a team or distribution address such as noc@company.com, networkadmin@company.com, or ciso@company.com instead of an individual user's email. This keeps the visible address generic and avoids exposing any single person's identity or creating a privacy concern inside the organisation.
Take Action
There might be a situation where you want to take an immediate action when an alert of a certain significance is raised i.e., when a critical alert is raised in the system.
Configure a policy to automate the appropriate action based on the severity of the alert raised. This means you can customise your policy to take different actions based on the severity of the alert.
Suppose you have configured a policy to trigger an alert when the CPU utilisation of a Virtual Machine goes above a certain threshold. You have configured the policy to trigger alerts in Major and Critical severity based on the threshold values specified in the policy.
Now, you want to automate different actions based on the alert severity. When the alert is in Major severity, you might want to restart the top processes consuming the CPU but when the alert is in Critical severity, you might want to restart the VM to make sure that the issue is resolved. ObserveOps allows you to automate this process by allowing a different Runbook to be executed based on the alert severity.