How to route alert events from ARMS Alert Management to an EventBridge event bus - Application Real-Time Monitoring Service

ARMS Alert Management allows you to route events about status changes in the alert lifecycle, such as alert creation, claim, and close, to your EventBridge event bus. By consuming these events, you can integrate with third-party systems for automated remediation or ticketing system integration. This topic describes how to route alert events from ARMS Alert Management to an EventBridge event bus.

Background information

EventBridge is a serverless event bus service provided by Alibaba Cloud that allows you to connect Alibaba Cloud services, custom applications, and SaaS applications in a standardized and centralized way. You can use EventBridge to route events between these applications based on the CloudEvents 1.0 protocol, which helps you build loosely coupled, distributed, event-driven architectures. For more information, see What is EventBridge?

Step 1: Create EventBridge resources

Create an EventBridge event bus. For more information, see Manage custom event buses.
After you create the event bus, obtain the public endpoint from the Event Bus Overview page.
Add an event source of the custom application type. For more information, see Manage custom event sources.
In the dialog box, set a Name (for example, arms) and an optional Description.

Step 2: Configure the EventBridge integration in ARMS

Log on to the ARMS console. In the left-side navigation pane, choose Alert Management > Integrations.
On the Integrations page, click the Notification Integration tab, and then click EventBridge.

In the Add Integration dialog box, configure the following parameters and click Save.

Parameter	Description
Name	A custom name for the integration, for example, `EventBridge-integration`.
Description	An optional description for the integration.
Endpoint	The public endpoint that you obtained in Step 1.
AccessKey	The AccessKey ID of your Alibaba Cloud account. For more information, see Obtain an AccessKey pair.
AccessKey Secret	The AccessKey secret of your Alibaba Cloud account. For more information, see Obtain an AccessKey pair.
Message Bus Name	The name of the event bus that you created in Step 1. For example, `armstest`.
regionId	The ID of the region where the event bus that you created in Step 1 is located. For example, `cn-hangzhou`.
Event Source Name	The name of the event source that you created in Step 1. For example, `arms`.

Step 3: Configure a notification policy

In a notification policy, set Ticket System to the EventBridge integration that you created in the previous step. For more information, see Notification policies.

Step 4: View alert events in the EventBridge console

Log on to the EventBridge console to view alert events. For more information, see Query events. On the Event Trace page of your target event bus, select the Query by time range tab to view the alert events sent from ARMS. The event types include aliyun:arms:alarm:create (Alert creation event), aliyun:arms:alarm:claim (Alert claim event), aliyun:arms:alarm:comment (Alert comment event), and aliyun:arms:alarm:close (Alert close event). You can click Event Trace or Event Detail for detailed information.

Event Type Code	Type
aliyun:arms:alarm:create	Alert creation event
aliyun:arms:alarm:claim	Alert claim event
aliyun:arms:alarm:comment	Alert comment event
aliyun:arms:alarm:close	Alert close event

In the Actions column for an event, click Event Details to view its parameters. The following sections show the payload format for each event type.

Alert creation event

{
    "datacontenttype": "application/json",
    "aliyunaccountid": "11xxxxxxxxxxx",
    "data": {
        "owner": "xx",  // The alert owner, which is the contact configured in the notification policy.
        "data": {        // The alert content. The format is compatible with open source AlertManager events. For more information, see the Prometheus official documentation at https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
            "alerts": [
                {
                    "fingerprint": "9b115ab3762a47b51a8efcb516d4aa50",
                    "annotations": {
                        "message": "Manually triggered test alert"
                    },
                    "startsAt": "2022-06-07T09:22:01.645000000Z",
                    "endsAt": "2022-06-07T09:27:39.099000000Z",
                    "labels": {
                        "severity": "error",
                        "regionId": "cn-hangzhou",
                        "_aliyun_arms_denoise_code": "0",
                        "_aliyun_arms_integration_name": "Custom integration",
                        "alertname": "Manually triggered alert",
                        "_aliyun_arms_product_type": "CUSTOM",
                        "_aliyun_arms_userid": "11xxxxxxxxxxx",
                        "_aliyun_arms_integration_id": "616",
                        "_aliyun_arms_is_denoise_filtered": "false"
                    },
                    "status": "firing"
                }
            ],
            "commonLabels": {
                "severity": "error",
                "regionId": "cn-hangzhou",
                "_aliyun_arms_denoise_code": "0",
                "_aliyun_arms_integration_name": "Custom integration",
                "alertname": "Manually triggered alert",
                "_aliyun_arms_product_type": "CUSTOM",
                "_aliyun_arms_userid": "11xxxxxxxxxxx",
                "_aliyun_arms_integration_id": "616",
                "_aliyun_arms_is_denoise_filtered": "false"
            },
            "externalURL": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",
            "groupLabels": {
                "alertname": "Manually triggered alert"
            },
            "receiver": "",
            "level": "P2",
            "dispatchRuleName": "O&M team",
            "startTime": "2022-06-07 17:22:01",
            "commonAnnotations": {
                "message": "Manually triggered test alert"
            },
            "status": "firing"
        },
        "timestamp": 1654593783951
    },
    "subject": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",   // The globally unique URL to locate the alert.
    "aliyunoriginalaccountid": "11xxxxxxxxxxx",
    "source": "arms",
    "type": "aliyun:arms:alarm:create",
    "aliyunpublishtime": "2022-06-07T09:23:04.003Z",
    "specversion": "1.0",
    "aliyuneventbusname": "armstest",
    "id": "d997f8c775d4d15b05f3346d5863fdc6******_create",
    "aliyunregionid": "cn-hangzhou",
    "aliyunpublishaddr": "xx.xx.xx.xx"
}

Alert claim event

{
    "datacontenttype": "application/json",
    "aliyunaccountid": "11xxxxxxxxxxx",
    "data": {
        "owner": "xx", // The owner of the alert.
        "handler": "xx", // The handler of the alert.
        "data": { // The alert content. The format is compatible with open source AlertManager events. For more information, see the Prometheus official documentation at https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
            "alerts": [
                {
                    "fingerprint": "9b115ab3762a47b51a8efcb516d4aa50",
                    "annotations": {
                        "message": "Manually triggered test alert"
                    },
                    "startsAt": "2022-06-07T09:20:43.780000000Z",
                    "endsAt": "2022-06-07T09:25:43.780000000Z",
                    "labels": {
                        "severity": "error",
                        "regionId": "cn-hangzhou",
                        "_aliyun_arms_denoise_code": "0",
                        "_aliyun_arms_integration_name": "Custom integration",
                        "alertname": "Manually triggered alert",
                        "_aliyun_arms_product_type": "CUSTOM",
                        "_aliyun_arms_userid": "11xxxxxxxxxxx",
                        "_aliyun_arms_integration_id": "616",
                        "_aliyun_arms_is_denoise_filtered": "false"
                    },
                    "status": "firing"
                }
            ],
            "commonLabels": {
                "severity": "error",
                "regionId": "cn-hangzhou",
                "_aliyun_arms_denoise_code": "0",
                "_aliyun_arms_integration_name": "Custom integration",
                "alertname": "Manually triggered alert",
                "_aliyun_arms_product_type": "CUSTOM",
                "_aliyun_arms_userid": "11xxxxxxxxxxx",
                "_aliyun_arms_integration_id": "616",
                "_aliyun_arms_is_denoise_filtered": "false"
            },
            "externalURL": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",
            "groupLabels": {
                "alertname": "Manually triggered alert"
            },
            "receiver": "",
            "level": "P2",
            "dispatchRuleName": "O&M team",
            "startTime": "2022-06-07 17:20:43",
            "commonAnnotations": {
                "message": "Manually triggered test alert"
            },
            "status": "firing"
        },
        "operator": "xx", // The operator.
        "timestamp": 1654593717195
    },
    "subject": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",
    "aliyunoriginalaccountid": "11xxxxxxxxxxx",
    "source": "arms",
    "type": "aliyun:arms:alarm:claim",
    "aliyunpublishtime": "2022-06-07T09:21:57.362Z",
    "specversion": "1.0",
    "aliyuneventbusname": "armstest",
    "id": "59e174db-f843-473a-9d3e-df3421******",
    "aliyunregionid": "cn-hangzhou",
    "aliyunpublishaddr": "118.31.XX.XX"
}

Alert comment event

{
    "datacontenttype": "application/json",
    "aliyunaccountid": "11xxxxxxxxxxx",
    "data": {
        "owner": "xx", // The owner of the alert.
        "handler": "xx", // The handler of the alert.
        "data": {  // The alert content. The format is compatible with open source AlertManager events. For more information, see the Prometheus official documentation at https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
            "alerts": [
                {
                    "fingerprint": "9b115ab3762a47b51a8efcb516d4aa50",
                    "annotations": {
                        "message": "Manually triggered test alert"
                    },
                    "startsAt": "2022-06-07T09:20:44.000000000Z",
                    "endsAt": "2022-06-07T09:22:00.000000000Z",
                    "labels": {
                        "severity": "error",
                        "regionId": "cn-hangzhou",
                        "_aliyun_arms_denoise_code": "0",
                        "_aliyun_arms_integration_name": "Custom integration",
                        "alertname": "Manually triggered alert",
                        "_aliyun_arms_product_type": "CUSTOM",
                        "_aliyun_arms_userid": "11xxxxxxxxxxx",
                        "_aliyun_arms_integration_id": "616",
                        "_aliyun_arms_is_denoise_filtered": "false"
                    },
                    "status": "resolved"
                }
            ],
            "commonLabels": {
                "severity": "error",
                "regionId": "cn-hangzhou",
                "_aliyun_arms_denoise_code": "0",
                "_aliyun_arms_integration_name": "Custom integration",
                "alertname": "Manually triggered alert",
                "_aliyun_arms_product_type": "CUSTOM",
                "_aliyun_arms_userid": "11xxxxxxxxxxx",
                "_aliyun_arms_integration_id": "616",
                "_aliyun_arms_is_denoise_filtered": "false"
            },
            "externalURL": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",
            "groupLabels": {
                "alertname": "Manually triggered alert"
            },
            "receiver": "",
            "level": "P2",
            "dispatchRuleName": "O&M team",
            "startTime": "2022-06-07 17:20:44",
            "endTime": "2022-06-07 17:22:00",
            "commonAnnotations": {
                "message": "Manually triggered test alert"
            },
            "status": "resolved"
        },
        "comment": "Solution: false positive", // The content of the comment.
        "operator": "xx", // The operator.
        "timestamp": 1654593720385
    },
    "subject": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",
    "aliyunoriginalaccountid": "11xxxxxxxxxxx",
    "source": "arms",
    "type": "aliyun:arms:alarm:comment",
    "aliyunpublishtime": "2022-06-07T09:22:00.435Z",
    "specversion": "1.0",
    "aliyuneventbusname": "armstest",
    "id": "ef38ca1b-89cb-4c7c-9052-b73e15******",
    "aliyunregionid": "cn-hangzhou",
    "aliyunpublishaddr": "118.31.XX.XX"
}

Alert close event

{
    "datacontenttype": "application/json",
    "aliyunaccountid": "11xxxxxxxxxxx",
    "data": {
        "owner": "xx", // The owner of the alert.
        "handler": "xx",  // The handler of the alert.
        "data": { // The alert content. The format is compatible with open source AlertManager events. For more information, see the Prometheus official documentation at https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
            "alerts": [
                {
                    "fingerprint": "9b115ab3762a47b51a8efcb516d4aa50",
                    "annotations": {
                        "message": "Manually triggered test alert"
                    },
                    "startsAt": "2022-06-07T09:20:44.000000000Z",
                    "endsAt": "2022-06-07T09:22:00.000000000Z",
                    "labels": {
                        "severity": "error",
                        "regionId": "cn-hangzhou",
                        "_aliyun_arms_denoise_code": "0",
                        "_aliyun_arms_integration_name": "Custom integration",
                        "alertname": "Manually triggered alert",
                        "_aliyun_arms_product_type": "CUSTOM",
                        "_aliyun_arms_userid": "11xxxxxxxxxxx",
                        "_aliyun_arms_integration_id": "616",
                        "_aliyun_arms_is_denoise_filtered": "false"
                    },
                    "status": "resolved"
                }
            ],
            "commonLabels": {
                "severity": "error",
                "regionId": "cn-hangzhou",
                "_aliyun_arms_denoise_code": "0",
                "_aliyun_arms_integration_name": "Custom integration",
                "alertname": "Manually triggered alert",
                "_aliyun_arms_product_type": "CUSTOM",
                "_aliyun_arms_userid": "11xxxxxxxxxxx",
                "_aliyun_arms_integration_id": "616",
                "_aliyun_arms_is_denoise_filtered": "false"
            },
            "externalURL": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",
            "groupLabels": {
                "alertname": "Manually triggered alert"
            },
            "receiver": "",
            "level": "P2",
            "dispatchRuleName": "O&M team",
            "startTime": "2022-06-07 17:20:44",
            "endTime": "2022-06-07 17:22:00",
            "commonAnnotations": {
                "message": "Manually triggered test alert"
            },
            "status": "resolved"
        },
        "solution": "",  // The solution for the alert.
        "operator": "xx", // The operator.
        "timestamp": 1654593720279
    },
    "subject": "https://arms.console.aliyun.com/#/alarm/alert/detail/12345",
    "aliyunoriginalaccountid": "11xxxxxxxxxxx",
    "source": "arms",
    "type": "aliyun:arms:alarm:close",
    "aliyunpublishtime": "2022-06-07T09:22:00.352Z",
    "specversion": "1.0",
    "aliyuneventbusname": "armstest",
    "id": "d997f8c775d4d15b05f3346d5863fdc6******_close",
    "aliyunregionid": "cn-hangzhou",
    "aliyunpublishaddr": "xx.xx.xx.xx"
}