Monte Carlo Integration Discovered Resources
Overview
The Monte Carlo integration has two outputs:
It creates and maintains a first-class
montecarlo_accountcontainer resource for the connected Monte Carlo account.It creates and maintains a first-class
montecarlo_monitorresource for every Monte Carlo monitor fetched in the crawl.It enriches existing table resources with active-alert data.
The integration does not discover or import warehouse hierarchy (databases, schemas, tables, views, models, or columns) by reference β those resources must already exist in Euno from another source integration.
Only alerts in active states (Investigating, No Status) are ingested. Alerts in terminal states (Fixed, No Action Needed, False Positive, Expected, Resolved, Closed, Acknowledged) are not stored or displayed.
Ingested Resources & Properties
Monte Carlo Account (montecarlo_account)
montecarlo_account)The top-level container resource created once per Monte Carlo source. Holds warehouse connection metadata and the warehouse-to-Euno mapping context used to resolve alerts to the correct resources.
name
The Monte Carlo account ID.
native_id
The Monte Carlo account ID.
montecarlo_warehouses
JSON list of warehouse connections returned by Monte Carlo's getWarehouses API.
database_mapping_context
The warehouse mapping configuration supplied during source setup (if any).
Monte Carlo Monitor (montecarlo_monitor)
montecarlo_monitor)One resource is created per monitor returned by Monte Carlo's getMonitors API. For CUSTOM_SQL monitors the full custom rule payload is also stored; for TABLE monitors the table monitor details are included.
name
Display name of the Monte Carlo monitor (falls back to the monitor UUID if no name is set).
native_id
Stable UUID of the monitor in Monte Carlo. Used for deduplication across crawls.
native_raw_object
Full monitor payload as returned by Monte Carlo (includes monitorType, scheduleType, labels, tags, ruleDescription, and all other monitor fields).
active_montecarlo_alerts
JSON list of active alerts associated with this monitor in the most recent crawl. Each entry includes the full alert detail payload plus a targets_uri field listing the Euno resource URIs of the impacted assets.
monte_carlo_active_alerts_targets
Deduplicated, sorted list of Euno resource URIs targeted by the monitor's active alerts. Used by the global processor to push alert data to impacted resources.
Table β Monte Carlo Alert Enrichment
When a table is the impacted asset of one or more active Monte Carlo alerts, the following property is added to the resource:
active_montecarlo_alerts
JSON list of active alerts attached to this resource. Aggregated from all montecarlo_monitor resources whose monte_carlo_active_alerts_targets includes this resource's URI. Each entry mirrors the alert detail payload (see Alert Payload below).
table
Alert Payload
Each entry in the active_montecarlo_alerts JSON list captures the information Euno extracts from the Monte Carlo alert payload.
Identity
id
UUID of the alert in Monte Carlo. Used for deduplication and updates.
uuid
Alternate alert UUID field (same value as id when both are present).
targets_uri
List of Euno resource URIs that this alert is attached to.
State
status
One of investigating, no_status. Terminal states (fixed, no_action_needed, false_positive, expected, resolved, closed, acknowledged) are ignored.
severity
One of SEV-1, SEV-2, SEV-3, SEV-4.
feedback
Optional triage feedback recorded by the user in Monte Carlo.
Time
createdTime
When the alert was first opened.
updatedTime
Last change time (state change, new anomaly, or assignment change).
Monitoring
name
Display name of the alert.
type
Alert type as returned by Monte Carlo.
monitorTags
Tags attached to the originating monitor ([{ name, value }]).
Assignment / Ownership
owner
User identifier for the alert owner ({ email } as returned by Monte Carlo).
Asset Locator
tables
List of Monte Carlo table references associated with the alert ([{ mcon, tableId, isKeyAsset }]).
assets
List of Monte Carlo asset references ([{ mcon, assetId, assetType }]).
Mapping Alerts to Euno Resources
Euno uses the Monte Carlo Canonical Object Name (MCON) from the alert's tables and assets fields, together with warehouse connection metadata, to resolve the impacted Euno resource URI. Alerts are only attached to resources that belong to a warehouse mapped to this Monte Carlo source.
Once resolved, Euno:
attaches the alert to the impacted resource via the global processor,
updates the resource's
active_montecarlo_alertslist,resolves or creates the corresponding
montecarlo_monitorresource and links the alert to it.
The relationship between an alert, its originating montecarlo_monitor, and the impacted warehouse / dbt resource is maintained on every run.
Relationships
montecarlo_account
has child
montecarlo_monitor
Every monitor is contained within the top-level account resource (parent_container).
Usage in EQL
You can filter and search by Monte Carlo properties in Euno's search and EQL:
Examples:
Last updated