Cloud Intelligence event trigger

You can use a Cloud Intelligence event trigger to start a flow using an event generated by Cloud Intelligence. Use it to automate responses to platform events—for example, post to Slack, create tickets, or run remediation steps when an alert fires, a budget threshold is crossed, or a cost anomaly is detected.

There are five categories of events:

• DoiT Cloud Intelligence events: DoiT Cloud Intelligence events that you can use to start flows.

• Applies when you use cost and usage alerts. Alerts: Fires when a cost or usage alert condition is satisfied or later resolves for the same period (and optional breakdown).

• Applies when you use Budgets with notification thresholds. Cloud Analytics budgets: Fires when spend crosses a budget alert threshold upward. This is separate from cost and usage alerts, which are metric and dimension-based rules on Alerts.

• Applies to AWS only. AWS CloudTrail: Events from AWS CloudTrail—for example, an EC2 instance being started or terminated, or an RDS instance created or modified.

• Available for any cloud where anomaly detection is configured (billing and/or real-time). Cost anomaly detection: Fires when cost anomalies are created or updated.

DoiT Cloud Intelligence events

DoiT Cloud Intelligence can emit platform events that trigger flows. When you select a DoiT Cloud Intelligence event, Event payload details shows the fields you can reference in your flow.

Alerts

You can trigger a flow when any of the following alert events occur. These use the same evaluation as alert notifications (for example, email and Zapier) when a condition is met or clears.

• DoiT Alert Condition Satisfied: When an alert's condition is met, for example, a cost threshold is met for the evaluated time period. For alerts evaluated per dimension (such as per service), an event can be emitted for each dimension value that triggers. The payload includes the value, the period that was evaluated, and alert details (name, threshold, metric, and so on). Sometimes an alert checks items one-by-one (for example, each service or each project), not just one grand total. In this situation, breakdown tells you which specific item triggered the alert (for example, Compute Engine) and breakdownLabel tells you the item category (for example, Service).

• DoiT Alert Condition Resolved: When an alert is resolved, for example, cost drops below the threshold for the same period. The alert aligns with DoiT Alert Condition Satisfied (same alert, period, and optional breakdown) so you can pair flows, for example, closing a Jira ticket or stopping follow-up actions you started when the condition was satisfied.

Budgets

You can trigger a flow when the DoiT Budget Threshold Reached event occurs. This event occurs when evaluated spend first crosses a budget alert threshold upward (for example 50%, 80%, or 100% of the budget amount). The payload includes the threshold crossed (thresholdPercentage), current spend and budget amounts, an optional forecasted date, when the threshold was reached (triggeredAt), and budget metadata (for example id, name, currency, and period). In the CloudFlow editor, exact field names are listed in Event payload details after you select this event. If multiple thresholds are passed, the event reflects the highest threshold percentage.

注意

Use Budgets with Configure budget notifications so alert thresholds exist for this event to occur.

Cost anomaly detection

You can trigger a flow when any of the following cost anomaly events occur:

• DoiT Cost Anomaly Acknowledged Changed: When an anomaly is acknowledged or the acknowledgement is edited.
• DoiT Cost Anomaly Cost Changed: When the cost of an active anomaly changes.
• DoiT Cost Anomaly Created: When a new cost anomaly is detected.
• DoiT Cost Anomaly Severity Changed: When the severity of an anomaly changes.
• DoiT Cost Anomaly Status Changed: When status changes (for example, Active to Inactive).
• DoiT Cost Anomaly Top SKUs Changed: When the top contributing SKUs for an anomaly change.

注意

You must have real-time cost anomaly detection configured to trigger flows for cost anomalies.

• Select an event: From the list, select a DoiT Cloud Intelligence event for which you want to trigger a flow.

• Event payload details: A list of referenced fields that are available within the selected event are displayed. These are the fields that you can reference in your flow.

• (Optional) Event payload filter: Add conditions on payload fields so the flow runs only when an incoming event matches the conditions. You can use a filter to start a flow only for a relevant case, for example, a specific cost anomaly severity, a particular AWS resource ARN, a chosen budget or budget threshold, or other values in the event data.

Event payload filter

You can filter which events trigger your flow by adding conditions based on the event payload. When one or more filter conditions are defined, the flow runs only when the incoming event matches the conditions. This lets you react to specific events, for example, triggering only when a cost anomaly has a particular severity or when an AWS CloudTrail event targets a specific resource.

When you add multiple conditions, they all must be true for the flow to continue. CloudFlow uses AND logic, meaning the flow won't move forward unless every single requirement is met.

情報

To check a single field for multiple values at once, use operators like In or Not In. This allows you to create a list of approved (or blocked) items. See Filter operators.

For example:

• Your flow listens for DoiT Cost Anomaly Created, but you only want it to run when the anomaly is Critical, not for every new anomaly. You can add the following condition:

  • Field: severity

  • Operator: Equal to (==)

  • Value: Critical

  

• For an AWS CloudTrail event, you might filter on a field such as details.resourceArn with contains and a substring of your production ARN (or use Equal to (==) with the full ARN) so the flow runs only when the API activity targets that resource.

• To narrow AWS CloudTrail activity to a specific cloud footprint, add multiple conditions so every one must match. For example, run the flow only when the event is in your production AWS account and a chosen Region:

  • Field: userIdentity.accountId — Operator: Equal to (==) — Value: your 12-digit AWS account ID (for example, 111122223333).

  • Field: awsRegion — Operator: Equal to (==) — Value: the Region code you care about (for example, eu-west-1).

  Use the names shown in Event payload details for your selected event; nested fields often appear with dot notation (for example, userIdentity.accountId).

• For DoiT Budget Threshold Reached, filter on budget.budgetId so the flow runs only for a specific budget, or on thresholdPercentage (for example, Equal to (==) with 100) so only certain thresholds start the flow. Use the field names shown in Event payload details. Nested budget fields are usually under budget.

To add a filter condition:

1. In Event payload filter, select + Add condition.

2. Configure the condition:

   • Field: Either select the field to display a list of available fields or manually type a field, for example, severity, details.resourceArn, budget.budgetId, or thresholdPercentage. The fields shown depend on the event you selected.

   • Operator: Choose a comparison operator. The Filter operators available depend on the field's data type.

   • Value: Enter the value to compare against. For timestamp fields, a date-time picker is shown. The value input is hidden for is null and is not null operators.

   

3. Select Save.

   To add multiple criteria that must all be true (AND), select + Add condition for each condition you want to include. You can edit or delete a condition at any time.

Automate event responses

When your flow is started by a DoiT Cloud Intelligence event trigger (DoiT Cloud Intelligence events, alerts, Cloud Analytics budgets, AWS CloudTrail, or cost anomaly detection), you can automate responses—for example, post to Slack, create tickets, or run remediation steps. Reference fields from Event payload details in your downstream nodes:

• Add a Notification node to send event details to your team. Use payload fields (for example, alert name and value for alert events, budget name and thresholdPercentage for DoiT Budget Threshold Reached, anomaly ID and cost for cost anomalies, or resource ARN for AWS CloudTrail events) in the message.

• Use a Branch node to run different steps depending on fields in that event's payload, for example, notify only when a cost anomaly's severity is high, when an alert's metric value is above a number you choose, when a budget threshold or budget.budgetId matches what you care about, or when a breakdown or other dimension field matches a specific project or service.

Event trigger example

You can automate responses from a trigger, for example, post to Slack, create tickets, or run remediation steps.

For example, a flow triggered by a DoiT Cost Anomaly Created can use a Branch node to filter for anomalies with a Critical severity. A Notification node then sends a message containing the anomaly ID and cost. Similarly, a flow triggered by DoiT Alert Condition Satisfied can notify a channel with the alert name, period, and value. A flow triggered by DoiT Budget Threshold Reached can branch on thresholdPercentage or budget.budgetId and notify with the budget name and current spend. These values come from the trigger node's output and can be mapped into any downstream node.

参照

• Trigger node results