Monitoring Observer API blacklist with Experience

Products

• AppNeta

Issue/Introduction

With our AppNeta observer, we are getting blacklisted and want to use AppNeta Experience to help monitor and determine if the event has occurred.

Cause

Blacklisting can occur for a variety for reasons, however you may want to consider ensuring your target is reachable, as repeat errors in sending to the target is the most common cause of blacklisting.

~~

There are several different caveats to this script that I wanted to capture.

Basic Steps

1. Set up some basic infrastructure
2. Create an API token with OrgAdmin & dynamic membership privileges
3. Build an Experience Web Path pointing at GET /v3/observer
4. Build the appropriate regex and add it to the Web Path
5. Build a regex to capture the exact blacklist event you are looking to monitor
6. Enable notifications for this Web Path
7. Add alerting conditions.

Resolution

1.   Although optional, we recommend creating a dummy or service account in AppNeta to manage email notifications, it can be view only, and make sure to fill in the description so that the purpose of the account is evident.  

• Make sure to keep the password it will be needed later
• Initially, this account will need Organizational Admin privileges, but after the creation of the token, the account should have its privilege level lowered.

2.  Create an API token with the OrgAdmin privilege level and make sure to select the dynamic membership option necessary to access the observer API.   You will require the token later in step 3.  Ensure your Token details are kept safe and saved, as the information can not be retrieved later.

3.  Set up an Experience Script

• Setup a Web App Group in experience
• Identify an appropriate monitoring point to host the Experience script
• Create a new Experience Web App Group with an appropriate name
• Provide a URL for the appropriate APM instance (app-01, app-02, etc)
  • e.g. https://app-11.pm.appneta.com/
• Create a new Experience Web Path and select HTTP
• Add a variable called token and value 'token' using your token id from step 2.  When you insert the token, it will appear as periods "..... "  see image below:

• For the Request add GET /api/v3/observer?allUsers=true&api_key=v3
• For Headers select Form and add "Accept", "application/json"
• Add another Form, this time "Authorization", "${token}".  This will use the variable 'token' which you set above.  See image below:

4.  To create a regex we will use the following regex string. For Expected Body, select 'Contains Regex' and paste in the following for the regex.

• .*blacklisted[": ]+false[,\\r\\n\\s"]+userId[": ][email protected]
  

  Replacing [email protected] with the appropriate userId string. For more information, you'll find an explanation of this regex here.

   

5.  Creating an appropriate alert profile will allow for notifications. This can be done from the "Alert Profile" section:

Then choose the "Create new Alert Profile"

 

From here you can setup a profile matching the conditions below, or make changes to the violation/clear events as needed in your environment.

6.  At this point, you should be able to test using the Preview button and if everything returns correctly, save this Web Path.

7.  Add the Experience path and its underlying Delivery path to a Saved List, and build a notification profile to alert for this condition, or add to an existing profile.  For more details on notification profiles, please have a look at our documents:

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/appneta/GA/set-up-monitoring/notifications.html