Skip to content

Feature Overview

EMS2, built on the powerful open-source platform keephq/keep, provides a robust set of features for alert management, correlation, and workflow automation. While we leverage the core capabilities of keephq/keep, we have also introduced significant enhancements to provide more granular control and better adapt to our enterprise environment.

This section provides an overview of both the core features and our custom enhancements.

Core Features (from keephq/keep)

We utilize the following core features from keephq/keep. For detailed documentation and examples, please refer to the official keephq/keep documentation.

  • Correlation: EMS2 correlates individual alerts into grouped alerts or associates them with existing incidents in CTG SNOW. This reduces noise and helps operators focus on the root cause of an issue. Correlation rules can be defined to group alerts based on time, source, or any other attribute.
  • Extraction: Extraction rules allow you to pull out and normalize important information from raw event payloads. This is crucial for standardizing data from various monitoring sources before it is processed by the rule engine.
  • Workflows: Workflows are sequences of automated actions that can be triggered by alerts. This enables you to build powerful automation for incident response, such as creating a Jira ticket, sending a Slack notification, or running a remediation script.

Enhanced Features

To better suit our needs, we have developed enhanced versions of some features, providing more flexibility and control.

  • Deduplication: Our enhanced deduplication engine offers a more sophisticated and hierarchical approach to alert fingerprinting. This allows for more flexible control over how alerts are grouped, significantly reducing redundant alerts.
  • Mapping: The enhanced mapping feature provides a dedicated mechanism for transforming and enriching incoming event data. This ensures that all data is normalized and conforms to our internal schema before deduplication, which enhances downstream automation and correlation.