The Event Orchestration Variables (cache variables) feature lets users save event information once events become alerts or incidents. This saved information can be used in Event Orchestration rules for conditions or actions. Variables can be set in both Global and Service Orchestrations, however they cannot be used outside of the orchestration where they were created. Using variables in Event Orchestration rules enables users to handle various new situations where understanding a system's status, event patterns, or timing is crucial for identifying the issue at hand.

There are two ways to store data in variables. Both variable types are populated whenever an event matches the conditions assigned to a cache variable:

• Recent event values: Assign data from an event to a variable.
• Count of events: Number of occurrences of events matching the variable’s condition.

📘

Tip

Configuring cache variable conditions works identically to setting Event Orchestration rule conditions.

Configure Event Orchestration Variables

Step 1: View Cache Variables

You can access Event Orchestration caches variables from either the Global Event Orchestration or Service Event Orchestration builder.

To view cache variables:

1. In the web app, navigate to Automation Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left. This will expand the Cache Variables pane.
3. Any existing variables will be displayed in this view. If no variables exist yet, you will be able to review some information about creating your first variable.

Step 2: Create a New Cache Variable

To create a new variable:

1. Click + Variable to open the variable creator modal.
2. Define the conditions that will determine when a variable is populated with data, and click Next.
   1. Note: Creating conditions for cache variables follows that same process as creating rules for Event Orchestration.
3. Enter a Variable Name and select a Variable Type from the dropdown: Event Data (CEF), Raw Data, or Event Count.
   1. The Variable Name is the display name that will appear in Event Orchestration rules and actions.
   2. The Variable Type defines what data is populated into a variable. There are three options for variable type and only one can be selected at a time for each variable. The three options are:
      1. Event Data (CEF): Stores CEF data associated with an event in the variable. Note: If an event’s data has been altered by Event Orchestration prior to variable population, the altered data will be stored in the variable.
      2. Raw Data: Allows users to target information in an event’s raw payload for storage.
      3. Event Count: Tracks the number of times an event matching the specified variable conditions has occurred.
4. When you are finished, click Save.

Step 3: Using Your Variable

Variables can be used in either Event Orchestration rule conditions or actions.

📘

Variable Duration

Stored values last for 24 hours or until they're replaced by a new value. When a new value is set, the 24-hour countdown starts again.

Use a Variable in a Condition

1. Click + New Rule or click to edit an existing rule in an Event Orchestration that contains variables.
2. Select If events match certain conditions from the condition type dropdown.
3. Assign the variable to either the target (e.g., event.summary) or value (i.e., the value being compared to whatever data is stored in the target) portion of the condition.
   1. To assign a variable to the target portion of an Event Orchestration condition, click the cell that shows event and scroll to the bottom of the resulting dropdown. Next, select Cache Variable. This will populate the cell with cache_var, which is how Event Orchestration references variables. Then type the variable name you wish to use after the period in the cell (e.g., cache_var.server_status).
   2. To assign a variable to the value portion of an Event Orchestration condition, click the cell that is blank in the condition builder. Type the name of the Variable you want to reference using the following syntax: cache_var.your_variable_name.

📘

Tip

Using a variable in the target portion of a condition means a rule will evaluate true or false without referencing the data in an event when an event is ingested. This allows you to create a logic gate that activates different branches of an Event Orchestration depending on what data is in a variable (e.g., maintenance_window, server_status, deployment_status, etc.).

Use a Variable in an Action

1. Navigate to the action you wish to reference the variable in. Supported actions are:
   1. Add incident note
   2. Replace event fields
   3. Webhooks
2. Add the variable to the action using the following syntax: {{cache_var.your_variable_name}}.
3. Click Save.

Edit Event Orchestration Variables

1. In the web app, navigate to Automation Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
3. To the right of your desired cache variables, click .
4. Make your desired changes to the variable's condition and click Next.
5. Make your desired changes to the variable's properties and click Save.

Disable or Delete Event Orchestration Variables

❗️

Disabled and Deleted Cache Variables

Please be advised that disabling or deleting a cache variable may lead to unexpected behavior if there any rules that still reference it. When a cache variable is disabled or deleted, it evaluates as NULL. For example, say you create a cache variable host and use it in a rule cache_var.host matches event.host. After disabling or deleting host, the rule would evaluate to NULL matches event.host.

As a best practice, please update your Event Orchestration rules before disabling or deleting a cache variable.

Disable an Event Orchestration Variable

1. In the web app, navigate to Automation Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Disable.
4. In the confirmation modal, click Disable.

To re-enable a cache variable, select Enable.

Delete an Event Orchestration Variable

1. In the web app, navigate to Automation Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Delete.
4. In the confirmation modal, click Delete.

Note: This action cannot be undone, and deleted cache variables cannot be recovered.

Product Limits

Variables per Orchestration

• Each Global Orchestration can have 100 Variables.
• Each Service Event Orchestration can have 100 Variables.
• Variables are not supported for Service Routes.

Variable Content

• Variables can store a maximum of 1024 characters.
• Variable data is stored as string data unless the variables type is set to event count, in which case the data is stored as an integer.

Variables Accuracy

During our Early Access program, cache variables will be accurate to the second level (i.e., if multiple events try to populate a variable in less than 1 second, we can not guarantee which order the variable will be populated in). This limit will be re-assessed based on Early Access feedback to determine if it needs to be adjusted.

FAQ

Can you use a cache variable created in a Global Orchestration as part of a Service Orchestration?

Can you view historical values for a variable?

What happens if a variable value exceeds 1024 characters?

Can non-string types be converted to strings?

What is the maximum value an Event Count variable can be?

What happens if two variables in the same Event Orchestration have the same name?

How can I tell what the current value of a variable is?

Is Event Orchestration variables API supported?