# Global Event Rulesets

Global Event Rulesets let you create rulesets for alert routing, eliminating the need for individual alert source webhooks setup for each Service. This centralized routing simplifies configuration management, saving time and enhancing efficiency, particularly for users dealing with numerous micro-services.

The scope for a ruleset is a Team, and the execution updates for Global Event Rulesets are recorded in the Incident Activity Timeline.

<figure><img src="https://lh4.googleusercontent.com/3bxYItAhXlUDJPjDM0IqpFYRHTjQTrlnzyVQp8K3yLJyR5JPsaQGc2dfhGuYncAvojqRbnh2BUn0p2A0xRCOezEMItC_3NfT0njZo0koVOPpJOd1xu3D1BJ535YK_DgivkW8O8MExWzjRaaG2s7-9Z4" alt="Global Event Rulesets flow in Squadcast for Incident Management" width="563"><figcaption><p>Image. Global Event Rulesets</p></figcaption></figure>

{% hint style="info" %} <mark style="color:blue;">**Note:**</mark> This feature will be available for accounts in the [<mark style="color:blue;">Enterprise plan</mark>](https://www.squadcast.com/pricing).
{% endhint %}

## Prerequisite

* To effectively create and manage Global Event Rulesets, the user assigned to the Team must possess the appropriate permissions corresponding to their User Role.

## Add Ruleset

To add new rulesets,

1. Navigate to **Global Event Rulesets** -> **Add New Ruleset**
2. Next, add the **Ruleset Name**, *optional* **Description**, and select the **Ruleset Owner**.
3. Click **Save**, and you're done.

{% hint style="info" %} <mark style="color:blue;">**Note:**</mark>

1. You can create and manage up to 30 rulesets for each Team.
2. A Ruleset Owner is a user or a Squad that someone can reach out to, for anything pertaining to that ruleset. There are no permissions associated with the ownership here.
   {% endhint %}

<div><figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-96a78fc77e9db6014b701ed2e4e82322512301b1%2FGER_12.png?alt=media" alt="Add Ruleset in Squadcast for Incident Management"><figcaption><p>Image. Add Ruleset</p></figcaption></figure> <figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-4097027d0775660a6963d1a2e47f7e6be8c2b3a2%2FGER_2.png?alt=media" alt="Details for added Ruleset in Squadcast for Incident Management"><figcaption><p>Image. Details for added Ruleset</p></figcaption></figure></div>

This creates a new ruleset, and the next step is to add alert sources and start creating rules for your ruleset. If you would like to create multiple such rulesets, each with individual endpoints, repeat the above steps as needed.

{% hint style="info" %} <mark style="color:blue;">**Note:**</mark> You can edit or delete a ruleset from its detail page.

Please note, that deleting a ruleset will remove all the mapped alert sources and their rules.
{% endhint %}

## Add Alert Sources

To add alert sources to a ruleset,

1. Navigate to **Global Event Rulesets** -> select the relevant ruleset from the list.
2. Click **Add Alert Source** -> In the side panel, search and select the alert source you wish to create a rule for -> Click **Add**.

{% hint style="info" %} <mark style="color:blue;">**Note:**</mark>

1. You can only add one alert source at a time.
2. Deleting an added alert source from the ruleset will result in all its rules getting deleted.
   {% endhint %}

<div><figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-f40b889d85776080613f92c1e59761d17fe39b14%2FGER_3.png?alt=media" alt="Add Alert Source in GER in Squadcast for Incident Management"><figcaption><p>Image. Add Alert Source</p></figcaption></figure> <figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-4097027d0775660a6963d1a2e47f7e6be8c2b3a2%2FGER_2.png?alt=media" alt="Added Alert Source in GER in Squadcast for Incident Management"><figcaption><p>Image. Added Alert Sources</p></figcaption></figure></div>

## Add Rules

Event rules allow you to set actions that should be taken on events that meet your designated rule criteria. In the current version, the only action that the system takes is routing of incoming alerts.

To add rules for an alert source,

1. Navigate to **Global Event Rulesets** -> select the relevant ruleset from the list.
2. For your added alert source, click **Add Rule.**
3. In the side panel, provide a **Rule Description** and create the **Rule Expression**, referring to the payload data available on the right.
4. Lastly, designate the Service for routing when the rule expression is met -> Click **Save**.

{% hint style="info" %} <mark style="color:blue;">**Note:**</mark> You can create and manage up to 1000 rules for each alert source.
{% endhint %}

<div><figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-fa4d7e41ed119bbadadcfa1036f12f3662f84e8d%2FGER_4.png?alt=media" alt="Add Rules for an Alert Source in Squadcast for Incident Management"><figcaption><p>Image. Add Rules for an Alert Source</p></figcaption></figure> <figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-4097027d0775660a6963d1a2e47f7e6be8c2b3a2%2FGER_2.png?alt=media" alt="View and arrange priority of added Rule in Squadcast for Incident Management"><figcaption><p>Image. View and arrange the priority of added Rule</p></figcaption></figure></div>

To manage the order of rule execution, simply use the arrows to rearrange the priority of these rules.

{% hint style="info" %} <mark style="color:blue;">**Note:**</mark>

1. The payload you see on the right may be a sample payload provided by Squadcast for the selected alert source, if you have not set up alert source webhooks and started receiving alerts yet. If the webhooks have been set up and you are receiving alerts, then you will see the payload of the latest alert for that alert source.
2. Also note that, if alert sources support multiple types of payloads for different events, please ensure you refer to the documentation of your alert source for the different payload structures.
3. You will see only the Services for the selected Team.
   {% endhint %}

{% hint style="warning" %} <mark style="color:orange;">**Important**</mark>: If you intend to delete a Service in Squadcast that is associated with a Global Event Ruleset, please ensure that you delete the rule first. Otherwise, you will receive a warning message similar to the one described below.

<img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-318a1a23bb847c53b0808764a092c4aecc84ee28%2FScreenshot%202023-10-03%20at%206.12.18%20PM.png?alt=media" alt="" data-size="original">
{% endhint %}

### Example

**Alert Source: Admin Labs**

```
{
    "webhookId": "5e3378c2-275d-11e8-89db",
    "monitorId": "1afb2342-2754-11e8-89db",
    "monitorName": "Example",
    "monitorAddress": "http://example.adminlabs.com/example.html",
    "stateChange": "down",
    "outageId": "4fd5c5df-275d-11e8",
    "outageStartedAt": "2018-03-14 08:57:09",
    "outageEndedAt": null,
    "maintenanceId": null
  }
```

**Example Rule Expression:**

```
payload.stateChange="down"
```

## Catch All Rule

Any alerts that are sent through event rules but do not match any are routed to the Service configured in the Catch All Rule. If the Catch All Rule is empty, the outlier alert is simply dropped from the system. Configuring this helps in making sure no alerts are missed, that is, every incoming alert ends up reaching a Service.

{% hint style="success" %}
🔹 **Best Practice Tip** 🔹 This is not mandatory, but we highly recommend having this configured.
{% endhint %}

To add a catch-all rule,

1. Navigate to **Global Event Rulesets** -> Select the relevant ruleset from the list.
2. For your added alert source, click **Add Catch All Rule** -> Select a **Service**.
3. Click **Save**.

<div><figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-c794255f998583aa5d18577fed211e66145860eb%2FGER_5.png?alt=media" alt="Add Catch All Rule for an Alert Source in Squadcast for Incident Management"><figcaption><p>Image. Add Catch All Rule for an Alert Source</p></figcaption></figure> <figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-2b20fe4f60ea60516ffc017b57319e168427f652%2FGER_6.png?alt=media" alt="View Added Catch All Rule in Squadcast for Incident Management"><figcaption><p>Image. View Added Catch All Rule</p></figcaption></figure></div>

*Have any questions?* [*Ask the community*](https://community.squadcast.com/view/home)*.*