workflow:
  id: critical-alert-enrichment
  name: Critical Alert Enrichment
  description: Enriches critical alerts with customer information from MySQL and creates ServiceNow incident tickets with detailed context.
  triggers:
    # filter on critical alerts
    - type: alert
      filters:
        - key: severity
          value: critical
  steps:
    # get the customer details
    - name: get-more-details
      provider:
        type: mysql
        config: " {{ providers.mysql-prod }} "
        with:
          query: "select * from blogpostdb.customer where customer_id = '{{ alert.customer_id }}'"
          single_row: true
          as_dict: true
          enrich_alert:
            - key: customer_name
              value: results.name
            - key: customer_email
              value: results.email
            - key: customer_tier
              value: results.tier
  actions:
    # Create service now incident ticket
    - name: create-service-now-ticket
      # if the alert already assigned a ticket, skip it
      if: "not '{{ alert.ticket_id }}'"
      provider:
        type: servicenow
        config: " {{ providers.servicenow-prod }} "
        with:
          table_name: INCIDENT
          payload:
            short_description: "{{ alert.name }} - {{ alert.description }} [created by Keep][fingerprint: {{alert.fingerprint}}]"
            description: "{{ alert.description }}"
          enrich_alert:
            - key: ticket_type
              value: servicenow
            - key: ticket_id
              value: results.sys_id
            - key: ticket_url
              value: results.link
            - key: ticket_status
              value: results.stage
            - key: table_name
              value: "{{ alert.annotations.ticket_type }}"
            - key: ticket_number
              value: results.number
