Event Enrichment

How Event Enrichment Works

Event Enrichment automatically adds contextual data to your PagerDuty events before they reach Event Orchestration, helping you route alerts more effectively and provide responders with the information they need.

Accounts can have one Default Event Enrichment that automatically applies to all Services and Event Orchestrations. You can exclude specific Services or Event Orchestrations from the Default if they don't need those rules.

Teams can also create custom Event Enrichments for their specific needs and associate them with relevant Services and Event Orchestrations.

For Event Orchestrations

When an event is ingested via an Event Orchestration global integration key:

1. Event Enrichment runs first:
   • If a custom Event Enrichment is associated Apply those rules
   • Otherwise, if a Default Event Enrichment exists Apply Default rule
2. Global Orchestration Rules are applied (if configured)
3. Service Routing Rules determine which Service receives the event
4. Service-level Event Enrichment runs:
   • If the Service has a custom Event Enrichment Apply those rules
   • Otherwise, if a Default Event Enrichment exists Apply Default rule
5. Service Orchestration Rules are applied (if configured)

For Services (Direct Integration)

When an event is ingested directly via a Service integration key:

1. Service-level Event Enrichment runs:
   • If the Service has a custom Event Enrichment Apply those rules
   • Otherwise, if a Default Event Enrichment exists Apply Default rule
2. Service Orchestration Rules are applied (if configured)

Create an Event Enrichment

1. Navigate to AIOps Event Enrichments.
2. Click New Event Enrichment.
3. Enter a name, assign an Owning Team, and optionally add a Description.
4. Click Save.

Navigate to the kabob menu to edit or set as a Default Event Enrichment.

Associate with Services and Event Orchestrations

1. In the Event Enrichment rule canvas, click the Associate button.
2. Choose which Services and Event Orchestrations to associate with the Event Enrichment.
   • For Default Event Enrichments: Select the Services and Event Orchestrations you want to exclude (they will not use the Default enrichment).

Add Enrichment Rules

Step 1: Define Conditions

1. Click + New Rule in the canvas (Default node).
2. Select a condition type from the dropdown.
3. Add your conditions (e.g., event.summary contains CMDB).
   • Use + And to combine multiple conditions.
   • Or Switch to code editor to write complex logic using PCL.

Step 2: Choose Action Type

Click Next, then choose one of two action types:

Option A: Enrich Events (Add CDP data)

Use this to join data from your CDP tables into the event.

1. Join data from: Select the CDP table to pull data from.
2. Match on: Choose which event field should match the query field in the CDP table.
3. Write to: Specify the event.custom_details.* field where enriched data will be added.

Option B: Transform Events (Extract or modify data)

Use this to extract values or compose new fields.

Extract:

• Select the field to extract data from.
• Provide a regex pattern to extract values.
• Specify the event field to write the extracted data to.

Transform:

• Compose a new value using existing event fields and static text.
• Specify the event field to write the composed value to.

Upload and Manage Enrichment Data

To learn more about uploading data to the enrichment service, verifying data, and troubleshooting, see the Upload and Manage Enrichment Data documentation.

Nested Rules

For complex rule structures using Connect Mode, see the Recombining Rules documentation.

Troubleshooting

Rule not working

• Verify the rule condition matched the incoming event.

Join not adding data

• Confirm the CDP table exists.
• Ensure the join key and value match exactly (case-sensitive, watch for extra whitespace).

Extract not working

• Validate your regex pattern against the actual source field. PagerDuty uses RE2 regex syntax.

Data missing or wrong

• Check if downstream Orchestration rules are overwriting fields ("last rule wins").