# AppDynamics

EvoHub receives AppDynamics health rule violations through an **HTTP Request Template** used by a policy action. A violation that starts opens an EvoHub alert; one that ends or is canceled resolves it.

## Set it up

:::steps
### Create the integration
In EvoHub, go to **On-Call → Integrations → + Add Integration**, choose **AppDynamics**, pick an **Escalation Policy** and click **Create Integration**. Copy the **Webhook URL**.
### Create the template
In AppDynamics, go to **Alert & Respond → HTTP Request Templates → New**. Set the method to `POST`, the **Raw URL** to your webhook URL, the payload MIME type to `application/json`, and paste the payload below. Use the template's **Test** button to check the variables resolve.
### Create the action and policy
Create an **HTTP Request** action that uses the template. In **Policies**, trigger it on health rule violations started, continuing, upgraded, downgraded, ended and canceled.
:::

```json
{"policy":"${policy.name}","event_type":"${latestEvent.eventType}","incident_id":"${latestEvent.incident.id}","health_rule":"${latestEvent.healthRule.name}","summary":"${latestEvent.summaryMessage}","display_name":"${latestEvent.displayName}","severity":"${latestEvent.severity}","app":"${latestEvent.application.name}","tier":"${latestEvent.tier.name}","node":"${latestEvent.node.name}","link":"${latestEvent.deepLink}"}
```

## What EvoHub reads

| EvoHub alert | Taken from |
| --- | --- |
| Title | The health rule (else `policy`) and `app`, for example *Business Transaction response time is much higher than normal — shop-prod*. |
| Description | `summary` with its HTML removed. |
| Labels | `event_type`, `app`, `tier`, `node`, `policy`, `health_rule`, `incident_id`, and `url` (the deep link). |

### Severity

| Event type | EvoHub severity |
| --- | --- |
| `POLICY_OPEN_CRITICAL`, `POLICY_CONTINUES_CRITICAL`, `POLICY_UPGRADED`, `ANOMALY_OPEN_CRITICAL`, `ANOMALY_UPGRADED` | critical |
| `POLICY_OPEN_WARNING`, `POLICY_CONTINUES_WARNING`, `POLICY_DOWNGRADED`, `ANOMALY_OPEN_WARNING`, `ANOMALY_DOWNGRADED` | medium |
| `POLICY_CLOSE_*`, `POLICY_CANCELED_*`, `ANOMALY_CLOSE_*`, `ANOMALY_CANCELLED_*` | resolves the alert |
| Other events | `severity`: ERROR high, WARN medium, INFO info |

## Resolve and deduplication

An alert is identified by the health rule violation (`incident_id`), so two business transactions or two nodes violating one policy are two alerts. Without an incident ID — an older body, or an event that is not a health rule violation — it is identified by the policy, the application and the node (or the tier when there is no node). Continuing, upgraded and downgraded violations update the open alert; a closed or canceled violation resolves it.

## Related

- [Integrations overview](https://docs.evohub.io/integrations-overview.md)
- [Honeycomb](https://docs.evohub.io/honeycomb.md)