How to link an ECC Queue record back to a specific Feature or Job


Description

All jobs that run via a MID Server, and some that don't, pass messages via the ECC Queue table [ecc_queue]. The Agent Correlator field [agent_correlator] is used by code to keep track of the originating job.

Although this list is in no way comprehensive, it should help you link an ECC Queue record back to the job it came from, to understand the code responsible. The code involved in launching the probe, the Probe code that runs in the MID Server , and Sensor code back in the instance, is usually owned by the particular feature, and the MID Server platform is simply running it in a java thread. 

IT Operations Management

ITOM Visibility

Discovery / Service Mapping

ECC Queue Topics:

Agent Correlator:

Source:

Sensors:

Test Credential

ECC Queue Topics:

Source:

Payload

Help The Helpdesk (HTHD) - Direct to Instance

ECC Queue Topics:

Agent:

Name:

Source:

Sensor Business Rule:

Agent Client Collector - Visibility (ACC-V)

See ACC-F in general

ITOM Optimization

Cloud Discovery - Direct from Instance

ECC Queue Topics:

Agent:

Agent Correlator:

Cloud Management

ECC Queue Topics:

Agent Correlator:

ITOM Health

Event Management

ECC Queue Topics:

Agent Correlator:

Source:

Name:

Agent Client Collector framework (ACC-F) / Monitoring (ACC-M)

ECC Queue Topics:

Health Log Analytics

ECC Queue Topics:

TBC

Operational Intelligence

ECC Queue Topics:

TBC

Integrations

Orchestration

ECC Queue Topics:

Agent Correlator:

Source:

Sensor Business Rule:

Quebec documentation: Deprecated: Orchestration activities: Probes used by Orchestration

Outbound REST / SOAP

ECC Queue Topics:

Agent Correlator:

Source:

Agent:

Sensor business rule:

LDAP

ECC Queue Topics:

Agent Correlator:

Agent:

Name:

Source:

Import Set / JDBC

ECC Queue Topics:

Agent Correlator:

Agent:

Name:

Source:

Sensor Business Rule:

Custom JavascriptProbe

ECC Queue Topics:

Source:

The payload contains a "script" parameter, which may identify the MID Server Script Include used by the probe.

IntegrationHub

ECC Queue Topics:

Agent Correlator:

Source:

Sensor business rule:

Syslog Integration

ECC Queue Topics:

Payload:

AttachmentCreator SOAP web service

ECC Queue Topics:

Name:

Source:

Export Sets

ECC Queue Topics:

Payload parameters:

3rd party:

JDBC File Loader

ECC Queue Topics:

Name:

Source:

Sensor business rule:

IT Service Management

Security Incident Response

The Security Incident Response application includes third-party integrations.

ECC Queue Topics:

Agent Correlator/Source/Payload:

Microsoft Exchange Online for Security Operations

Docs: Microsoft Exchange Online integration (Rome)

The integrations are implemented by Powershell Orchestration Workflow activities:

MID Selection Criteria:

ECC Queue Topics:

Name:

Payload:

Agent Correlator:

Source:

Sensor Business Rule:

Employee Document Management

ECC Queue Topics:

Payload parameters:

Sensor business rule:

Now Platform

Source Control

ECC Queue Topics:

Name

Sensor Business Rule

MID Server

ECC Queue

ECC Queue Topics:

System Commands

ECC Queue Topics:

Source: