Skip to content

Conversation

@nexicturbo
Copy link

Summary

Add a new SolarWinds provider that pulls active alerts from SolarWinds Orion using the SWIS (SolarWinds Information Service) REST API.

/claim #3526

What's Included

Provider Files

  • keep/providers/solarwinds_provider/__init__.py
  • keep/providers/solarwinds_provider/solarwinds_provider.py
  • keep-ui/public/icons/solarwinds-icon.png

Features

  • Alert pulling via SWQL queries joining Orion.AlertActive, Orion.AlertObjects, and Orion.AlertConfigurations
  • Severity mapping: SolarWinds severity levels (Information=0, Warning=1, Critical=2, Serious=3, Notice=4) mapped to Keep's AlertSeverity enum
  • Status mapping: Active alerts → FIRING, Acknowledged alerts → ACKNOWLEDGED
  • Authentication: Basic auth (username/password) against the SWIS REST API
  • SSL verification toggle: Can be disabled for on-premises deployments with self-signed certificates
  • Scope validation: Lightweight SWQL query to verify connectivity and authentication
  • Provider icon for the Keep UI

SolarWinds API Details

  • Uses the SWIS REST API endpoint: https://{host}:17774/SolarWinds/InformationService/v3/Json/Query
  • Queries use SWQL (SolarWinds Query Language) to fetch active alert data
  • No external SDK required — uses raw requests library (consistent with Keep's provider pattern)

Configuration

Field Description Required Sensitive
host_url SolarWinds Orion Server URL (including port) Yes No
username SolarWinds API Username Yes No
password SolarWinds API Password Yes Yes
ssl_verify Verify SSL certificates No (default: true) No

Alert Data Mapped

Each active alert includes:

  • Alert name and entity caption
  • Severity (mapped from SolarWinds numeric levels)
  • Status (firing/acknowledged)
  • Triggered date/time
  • Description (triggered message or alert description)
  • URL to entity details page
  • Related node information
  • Acknowledgement details

References

Closes #3526

Add a new SolarWinds provider that pulls active alerts from SolarWinds
Orion using the SWIS (SolarWinds Information Service) REST API.

Features:
- Queries active alerts via SWQL joining AlertActive, AlertObjects,
  and AlertConfigurations entities
- Maps SolarWinds severity levels (Information/Warning/Critical/
  Serious/Notice) to Keep's AlertSeverity enum
- Maps alert status (active/acknowledged) to Keep's AlertStatus
- Supports basic auth with optional SSL verification toggle
  (useful for on-premises deployments with self-signed certificates)
- Includes provider icon for the Keep UI

Closes keephq#3526
@vercel
Copy link

vercel bot commented Jan 28, 2026

@nexicturbo is attempting to deploy a commit to the KeepHQ Team on Vercel.

A member of the Team first needs to authorize it.

@dosubot dosubot bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Jan 28, 2026
@CLAassistant
Copy link

CLAassistant commented Jan 28, 2026

CLA assistant check
All committers have signed the CLA.

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Jan 28, 2026

Target branch is not in the allowed branches list.

@dosubot dosubot bot added Feature A new feature Provider Providers related issues labels Jan 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🙋 Bounty claim Feature A new feature Provider Providers related issues size:L This PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[🔌 Provider]: Solarwinds

2 participants