Field values for Status, Severity and Owner in Episode are intermittently not written properly for itsi_grouped_alerts

Applicability

Description

When using Bidirectional correlation searches, or custom correlation searches to update existing episode, those Episodes fields (Severity, Status, Assignee) would have their previous field values emptied and replaced by %owner% / %severity% / %status.

Investigation

To scan the Episodes with unexpected fields, use that search :

index="itsi_grouped_alerts" itsi_group_assignee="%owner%"  OR itsi_group_severity="%severity%" OR itsi_group_status="%status%"
| table _time itsi_group_id event_id itsi_policy_id itsi_group_assignee itsi_group_severity itsi_group_status 

Use the field itsi_group_id to identify the Episode and search it on the Episode dashboard.

Look at the NEAP used, check if the NEAP settings are :

• Episode Severity - Same as the last event
• Episode Assignee - Same as the last event
• Episode Status - Same as the last event

Look at the last notables events (event_id) in the index=itsi_tracking_alerts, confirm what is the source. 
The source should be the name of the correlation search, review if this a loopback correlation search (like a bidirectional search). Verify by running search is the fields status/severity/owner are present in it.

Resolution

The issue is a bug (ITSI-45612), fixed in ITSI 5.0.3 . And it due to the NEAP settings to use the latest event values from the fields.
If the last notable event has no values for the fields, it will erase the existing values in the episode.
And Bidirectional Ticketing correlation searches usually do not include those fields.

Long term Fix:

• When available upgrade to ITSI 5.0.3

Workarounds for older versions:

• if necessary, change the NEAP setting to not use the "latest" values for the fields. The tradeoff is that new episodes will no longer inherit severity/status/assignee from the last event.
• in the Correlation Searches, use lookup on the Episode to add the latest Episode Fields (Severity, Status, Assignee) to the Notable Event.