Monte Carlo Integration Discovered Resources

Overview

The Monte Carlo integration has two outputs:

1. It creates and maintains a first-class montecarlo_account container resource for the connected Monte Carlo account.

2. It creates and maintains a first-class montecarlo_monitor resource for every Monte Carlo monitor fetched in the crawl.

3. It enriches existing table resources with active-alert data.

The integration does not discover or import warehouse hierarchy (databases, schemas, tables, views, models, or columns) by reference — those resources must already exist in Euno from another source integration.

Only alerts in active states (Investigating, No Status) are ingested. Alerts in terminal states (Fixed, No Action Needed, False Positive, Expected, Resolved, Closed, Acknowledged) are not stored or displayed.

Ingested Resources & Properties

Monte Carlo Account (montecarlo_account)

The top-level container resource created once per Monte Carlo source. Holds warehouse connection metadata and the warehouse-to-Euno mapping context used to resolve alerts to the correct resources.

Property	Description
name	The Monte Carlo account ID.
native_id	The Monte Carlo account ID.
montecarlo_warehouses	JSON list of warehouse connections returned by Monte Carlo's getWarehouses API.
database_mapping_context	The warehouse mapping configuration supplied during source setup (if any).

Monte Carlo Monitor (montecarlo_monitor)

One resource is created per monitor returned by Monte Carlo's getMonitors API. For CUSTOM_SQL monitors the full custom rule payload is also stored; for TABLE monitors the table monitor details are included.

Property	Description
name	Display name of the Monte Carlo monitor (falls back to the monitor UUID if no name is set).
native_id	Stable UUID of the monitor in Monte Carlo. Used for deduplication across crawls.
native_raw_object	Full monitor payload as returned by Monte Carlo (includes monitorType, scheduleType, labels, tags, ruleDescription, and all other monitor fields).
active_montecarlo_alerts	JSON list of active alerts associated with this monitor in the most recent crawl. Each entry includes the full alert detail payload plus a targets_uri field listing the Euno resource URIs of the impacted assets.
monte_carlo_active_alerts_targets	Deduplicated, sorted list of Euno resource URIs targeted by the monitor's active alerts. Used by the global processor to push alert data to impacted resources.

Table — Monte Carlo Alert Enrichment

When a table is the impacted asset of one or more active Monte Carlo alerts, the following property is added to the resource:

Property	Description	Applicable Resources
active_montecarlo_alerts	JSON list of active alerts attached to this resource. Aggregated from all montecarlo_monitor resources whose monte_carlo_active_alerts_targets includes this resource's URI. Each entry mirrors the alert detail payload (see Alert Payload below).	table

Alert Payload

Each entry in the active_montecarlo_alerts JSON list captures the information Euno extracts from the Monte Carlo alert payload.

Identity

Field	Description
id	UUID of the alert in Monte Carlo. Used for deduplication and updates.
uuid	Alternate alert UUID field (same value as id when both are present).
targets_uri	List of Euno resource URIs that this alert is attached to.

State

Field	Description
status	One of investigating, no_status. Terminal states (fixed, no_action_needed, false_positive, expected, resolved, closed, acknowledged) are ignored.
severity	One of SEV-1, SEV-2, SEV-3, SEV-4.
feedback	Optional triage feedback recorded by the user in Monte Carlo.

Time

Field	Description
createdTime	When the alert was first opened.
updatedTime	Last change time (state change, new anomaly, or assignment change).

Monitoring

Field	Description
name	Display name of the alert.
type	Alert type as returned by Monte Carlo.
monitorTags	Tags attached to the originating monitor ([{ name, value }]).

Assignment / Ownership

Field	Description
owner	User identifier for the alert owner ({ email } as returned by Monte Carlo).

Asset Locator

Field	Description
tables	List of Monte Carlo table references associated with the alert ([{ mcon, tableId, isKeyAsset }]).
assets	List of Monte Carlo asset references ([{ mcon, assetId, assetType }]).

Mapping Alerts to Euno Resources

Euno uses the Monte Carlo Canonical Object Name (MCON) from the alert's tables and assets fields, together with warehouse connection metadata, to resolve the impacted Euno resource URI. Alerts are only attached to resources that belong to a warehouse mapped to this Monte Carlo source.

Once resolved, Euno:

• attaches the alert to the impacted resource via the global processor,

• updates the resource's active_montecarlo_alerts list,

• resolves or creates the corresponding montecarlo_monitor resource and links the alert to it.

The relationship between an alert, its originating montecarlo_monitor, and the impacted warehouse / dbt resource is maintained on every run.

Relationships

Source type(s)	Relationship	Target type(s)	Notes
montecarlo_account	has child	montecarlo_monitor	Every monitor is contained within the top-level account resource (parent_container).

Usage in EQL

You can filter and search by Monte Carlo properties in Euno's search and EQL:

Examples:

# Tables that have at least one active Monte Carlo alert attached
active_montecarlo_alerts != null and type = "table"

# All Monte Carlo monitors (shows monitors from all crawls)
type = "montecarlo_monitor"

# All Monte Carlo account containers
type = "montecarlo_account"