Event Management

Overview

Event Management gives external monitoring tools a single ingestion point for raw signals — an Event record — independent of whether or how that signal eventually becomes an incident. Events carry a severity, an optional link to a CMDB configuration item, and a lifecycle of their own (open → acknowledged → resolved → closed). Correlation rules can then group related events and, when a threshold is crossed, automatically open an incident.

Event Fields

Alert Ingestion

External monitoring tools post events to a single authenticated ingest endpoint. source, severity, and message are required; everything else is optional.

POST /api/event-management/ingest
{
  "source": "datadog",
  "severity": "critical",
  "message": "CPU usage above 95% on db-primary-01",
  "ciId": "665f1e2a9c1d4a0012ab34cd",
  "metadata": {
    "host": "db-primary-01",
    "metric": "cpu.usage",
    "threshold": 95
  }
}

A sequential number (EVT-...) is generated and the event is stored with status: "open" and receivedAt set to the current time.

CI Correlation

An event links to a CMDB configuration item through its ciId field, set at ingest time by the caller (the monitoring tool or an integration is responsible for resolving its own device/host identifier to a FlowOS CI). See CMDB for configuration item records. Once set, ciId is used to:

• •Filter events by CI in GET /api/event-management (?ciId=...).
• •Carry impact context onto an incident created from the event — both the manual create-incident action and rule-based auto-creation copy ciId onto the resulting incident’s ciId and affectedCiIds.
• •Scope correlation rules to a specific CI via a rule’s matchCiId condition.

Auto-Incident Creation

An event can turn into an incident in two ways:

1. Manual, per-event

An agent reviewing a single open event can promote it directly:

This creates an incident titled Event: {message}, maps the event's severity to an incident priority (critical→critical, major→high, minor→medium, warning→low, info→low), sets contactType: "alert", and copies ciId onto the incident. The source event is then updated with correlatedIncidentId and moved to status: "acknowledged".

2. Automatic, via correlation rules

Event Correlation Rules (/api/event-management/correlation-rules) match a window of recent open events by severity, source (regex), CI, and/or message pattern, and trigger when at least thresholdCount matching events land within thresholdWindowMinutes. A rule with action: "create_incident" auto-creates an incident (title from the incidentTitle template, priority from incidentPriority) and marks every matching event's correlatedIncidentId, so the same burst of events is not correlated into a second incident. Rules also support group, suppress, and escalate actions. Evaluation runs via:

Acknowledge

Moves an open event to acknowledged, recording who and when. Only succeeds on events currently status: "open".

Stats

Summary counters for dashboards — total events, currently open, and open events at critical/major severity.

// GET /api/event-management/stats
{
  "success": true,
  "data": { "total": 1842, "open": 37, "critical": 4, "major": 11 }
}

API Quick Reference