Rulebook activations

A rulebook activation lets the tools you already run start the fix. When your alerting tool sends an event, Gardience checks it against your conditions, finds the machine it names, and starts a runbook on that machine or a workflow. Find it under Automation > Rulebook activations (admins only).

1. Choose New activation.
2. Give it a name and choose where events come from: Prometheus Alertmanager, Grafana alerting, Splunk alert, ServiceNow, Datadog, or any webhook that sends JSON.
3. Machine is in the field: the field of the event that holds the machine's name. Gardience fills in the usual one for each source (for Alertmanager and Grafana, labels.instance).
4. Add conditions, for example labels.alertname equals DiskFull. Each condition compares one field: equals, does not equal, contains, starts with, or is present. Choose whether all of them or any of them must be true. With no conditions, every event counts.
5. Choose what to run: a runbook or a workflow.
6. Set Wait between runs on the same machine (default 30 minutes).
7. Leave A second person approves each run first on unless you want it to run by itself. Workflows always wait for approval.
8. Save. Gardience shows the address and a token once. Copy both into your alerting tool.

Send events with an HTTP POST to the address, with the token in an Authorization: Bearer header. For Prometheus Alertmanager, Gardience shows a ready receiver:

receivers:
  - name: gardience
    webhook_configs:
      - url: https://YOUR-GARDIENCE/gardience/api/hooks/ACTIVATION-ID
        send_resolved: false
        http_config:
          authorization:
            credentials: TOKEN

A tool that cannot set a header can send the token as ?token= on the address instead; a header is better, because addresses are often written to logs.

• An Alertmanager or Grafana message can hold several alerts. Each firing alert is its own event; resolved alerts are ignored.
• The machine must be in your fleet. A port or a domain is dropped first, so web-01:9100 and web-01.example.com both mean web-01. An event that names no known machine starts nothing.
• Nothing from the event reaches a command. The runbook's inputs are fixed when you save the activation; the event only chooses which known machine it runs on.
• The run belongs to the admin who saved the activation. Their own permissions and team limits apply, the same as their API keys.
• At most one run per machine within the waiting time, and at most 20 runs an hour for one activation. Events past those limits are recorded and skipped.
• Every event is listed under Recent events with what it did, and every run is in the audit log.

Test on an activation takes a sample event (JSON) and shows what it would do, without running anything.

• New token makes a new token at once; the old one stops working.
• A wrong token and a wrong address get the same answer, so the address cannot be guessed from the reply.
• Events larger than 256 KB are refused, and each address is rate limited.

• Drift checks and event rules
• Runbooks
• Workflows and approvals