Summary

Add a new SolarWinds provider that pulls active alerts from SolarWinds Orion using the SWIS (SolarWinds Information Service) REST API.

/claim #3526

What’s Included

Provider Files

• keep/providers/solarwinds_provider/__init__.py
• keep/providers/solarwinds_provider/solarwinds_provider.py
• keep-ui/public/icons/solarwinds-icon.png

Features

• Alert pulling via SWQL queries joining Orion.AlertActive, Orion.AlertObjects, and Orion.AlertConfigurations
• Severity mapping: SolarWinds severity levels (Information=0, Warning=1, Critical=2, Serious=3, Notice=4) mapped to Keep’s AlertSeverity enum
• Status mapping: Active alerts → FIRING, Acknowledged alerts → ACKNOWLEDGED
• Authentication: Basic auth (username/password) against the SWIS REST API
• SSL verification toggle: Can be disabled for on-premises deployments with self-signed certificates
• Scope validation: Lightweight SWQL query to verify connectivity and authentication
• Provider icon for the Keep UI

SolarWinds API Details

• Uses the SWIS REST API endpoint: https://{host}:17774/SolarWinds/InformationService/v3/Json/Query
• Queries use SWQL (SolarWinds Query Language) to fetch active alert data
• No external SDK required — uses raw requests library (consistent with Keep’s provider pattern)

Configuration

Alert Data Mapped

Each active alert includes:

• Alert name and entity caption
• Severity (mapped from SolarWinds numeric levels)
• Status (firing/acknowledged)
• Triggered date/time
• Description (triggered message or alert description)
• URL to entity details page
• Related node information
• Acknowledgement details

References

• SolarWinds SWIS API Wiki
• SWIS REST API
• Alert Entities

Closes #3526