# First Response Policy

## Introduction

First Response Policy in OpsRamp allows you deliver first response actions to reduce redundant and repeated alerts. The first response actions are driven by machine-learning such as resolving an alert or providing a root cause of the alert before assigning the alert to an appropriate user. Addressing each and every alert with manual, labor-intensive processes is a tedious task. First response policies act as a first response mechanism for frequent and unnecessary alerts.

OpsRamp provides two options for configuring first response policies:

* **Time-Based Suppression (Suppress seasonal and periodic alerts)**: This option is suited to suppress alerts that occur in a periodically repeating pattern. For example:

  * CPU and memory alerts from a server due to nightly backup jobs
  * Availability alerts from cloud VMs that are automatically shut down nightly

  OpsRamp automatically learns occurrence patterns of alerts and suppresses those alerts that occur at a predictable sequence. If such an auto-suppressed alert should remain open for longer than predicted, OpsRamp automatically un-suppresses the alert ensuring that the conditions responsible for the real problem and need user attention are not lost.\
  &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/OpsQ-Bot-Unsupression-Message-1024x482.png)
* **Attribute-Based Suppression (Suppress alerts that match specific characteristics)**: This option is suited to suppress known alerts that are always suppressed as part of a standard operating procedure. You need to provide data in CSV format that includes examples of alerts that need to be suppressed as input. To let OpsRamp automatically learn which alerts needs to be suppressed based on existing data, you can select the continuous learning option. OpsRamp automatically starts suppressing alerts on behalf of users after learning about the suppressing patterns followed by users.

## Create First Response Policy

First response policy allows you to to auto-suppress alerts as a first response mechanism for frequent and unnecessary alarms.

Perform the following steps to create a first response policy:

1. Log into **OpsRamp**.
2. Click **All Clients** and from the displayed list select a client.
3. From the options in the drop-down menu, select **Setup**.\
   &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/Setup-drop-down-option.png)
4. From the left pane, click **Alert Management** menu and then click **First Response**.\
   &#x20;**First Response Policies** page is displayed.\
   &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/First-Response-Policies-Initial-Page-1.png)
5. Click **Add** to create a first response policy.\
   &#x20;**New First Response Policy** page is displayed.\
   &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/New-First-Reponse-Policy-Page-800x364.png)
6. Provide unique **name** for the policy.
7. Select a client from the **Client** drop-down menu.
8. Select the required enabled mode from the **Enabled** drop-down menu.\
   &#x20;**Description of Multiple Enabling Modes for First Response Policy**

   | Enabled Mode | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
   | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | ON           | First Response policy is created and alert suppression is performed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
   | Observed     | <p>Observed mode enables you to see potential alerts that would be suppressed by the policy without creating a real First Response policy. In Observed mode, an Observed alert is created for each alert that is to be suppressed. You can view the Observed alerts in the <strong>Alerts</strong> browser. These alerts are indicated with <strong>Observed</strong> status. Any action performed on an alert with Observed status does not affect the actual alert.</p><p><strong>Note</strong>: You can only perform <strong>Close</strong> action on an alert having Observed status.</p> |
   | OFF          | First Response policy is created, but no alert suppression is performed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

![](https://docs.opsramp.com/wp-content/uploads/2019/07/Name-and-Enabled-Mode-First-Response-Policy-800x440.png)

After providing the initial details for the policy, apply the first response policy to relevant client resources.

### Filter Criteria

In filter criteria section, select resources whose alerts match this policy.

Perform the following steps:

1. Select **Filter Criteria**.\
   &#x20;Filter condition fields appear.
2. Select **Any** to filter alerts that match any of the rules or select **All** to filter alerts that match all the rules.
3. From the **Native Attributes** drop-down list:
   * Select **Native Attributes** to use the available attributes that are predefined in the OpsRamp.\
     &#x20;*Example*: Host Name, DNS Name or IP Address.
   * Select **Custom Attributes** to filter the alerts based on specific custom attributes of a client or a resource.
4. From attributes drop-down list, select required attribute.
5. From Operators drop-down list, select required Operator and provide the values.\
   &#x20;**Note**: Click ![](https://docs.opsramp.com/wp-content/uploads/2019/05/Add-multiple-filter-criteria.png) to add additional filter criteria.

![](https://docs.opsramp.com/wp-content/uploads/2019/07/Filter-Criteria-First-Response-Policy-800x442.png)

### Policy Definition

Define conditions for suppressing alerts.

Perform the following steps:

1. Select either of the following options:
   * Select **Time Based** to analyze seasonal patterns and suppress alerts without any human intervention.\
     &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/Policy-Definition-Time-Based-800x440.png)
   * Select **Attribute Based** to suppress alerts that match specific conditions.\
     &#x20;This model requires a [training data file in CSV format](#Appendix_Creating_a_training_CSV_file) that includes examples of alerts that need to be suppressed. OpsRamp applies machine-learning to learn patterns from the input CSV file and uses the learned pattern to drive auto-suppression of alerts. The learned models are applied against the incoming alerts.\
     &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/Policy-Definition-Attribute-Based-800x499.png)\
     &#x20;If you select **Attribute Based** option, perform the following steps:
     1. Click **Drop the training data file here, or browse** to upload a CSV file.\\

        **Note**: One client can upload only one training file. Changing the training file affects all learned policies of the client.
     2. Select the file from your local folder.\
        &#x20;On uploading the file **Input** and **Output** columns appear.
     3. Validate the **Input** and **Output** columns.\
        &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/Input-and-Putput-Columns-1.png)
     4. Enable **Continuous Learning** toggle button to let OpsRamp automatically learn which alerts needs to be auto-suppressed based on the suppress actions in the existing data.\
        &#x20;OpsRamp will automatically start suppressing alerts on behalf of users after learning about the suppressing patterns followed by users.
     5. Click **Continue to Model Training**.\
        &#x20;The accuracy of the trained First Response policy appears in the **Trained Model** **Summary** section.\
        &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/Tained-Model-Summary-800x242.png)
2. Click **Save**.

First response policy is created and appears in the **First Response Policies** page.

## First Response Policies List

Once a policy is saved, the policy appears on **First Response Policies** page.

You can view information about the number of times a pattern was detected and number of automatic suppression already performed. If you hover over the **ML** icon, you can view the model accuracy and number of seasonal patterns matched.

**Notes**:

* If the policy is **Time based**, you can view the number of seasonal patterns matched.
* If the policy is **Attribute based**, you can view the model accuracy.
* If the policy is both **Time based** and **Attribute based**, you can view the model accuracy and the number of seasonal patterns matched.

![](https://docs.opsramp.com/wp-content/uploads/2019/07/First-Response-Policies-Page.png)

## Appendix: Creating a training CSV file

Prior to enabling the attribute based auto-suppression model, create a CSV file and add the alert attributes to the file.

**Notes**:

* OpsRamp provides an example CSV file (Alert\_Suppression\_Training\_Example.csv) for your reference.\
  &#x20;![](https://docs.opsramp.com/wp-content/uploads/2019/07/Example-CSV-File-600x207.png)
* See [instruction 3 in Configure CSV File](https://docs.opsramp.com/classification-training-csv-file/#Configure_CSV_File) section for creating a CSV file for First Response policy. See [Supported Input Columns](https://docs.opsramp.com/classification-training-csv-file/#Supported_Alert_and_Resource_Properties_in_Input_Columns) for input column headers and see [Supported Output Columns](https://docs.opsramp.com/classification-training-csv-file/#Supported_Learned_Configurations_for_Output_Columns) for output header.

**Important points to consider while creating a CSV file**:

* Maximum file size must be 100 MB
* Each column in CSV must have a column header
