Closed-List Incident Tags
Limit tag values to a set of dropdown options with closed-list incident tags.
Incident tags allow you to quickly see metadata for a particular incident rather than needing to review all of the related alerts. These tags add contextual information, details, or other enrichment data sets to your incidents.
Free-text tags offer more flexibility in tag values, but increase the risk of errors such as typos or unstandardized naming conventions. This makes it more challenging for administrators to normalize incident enrichment data.
Closed-list tags let you control the allowed values in tags with a defined list of values, so you can standardize your automation scenarios, simplify value selection, and reduce human error.
With this new functionality, you can:
- Configure a closed list of values for tag enrichment
- Choose to make dropdown values single-select or multi-select
- Make configuration changes in both the UI and Incident Tag Definitions API
Relevant Permissions
Roles with the following permissions can access Incident Tags:
| Permission Name | Description |
|---|---|
| Incident Actions | View, add, edit, or remove the incident tag from incidents in some or all environments. |
| View Incidents | View incident tags on incidents in some or all environments. |
| Incident Enrichment | View, create, and edit incident tags in the Incident Tags section of the BigPanda Settings. |
Permission access levels can be adjusted by selecting either View or Full Access. To learn more about how BigPanda's permissions work, see the Roles Management documentation.
New Tag Types
With closed-list tags, you can add or update values for an incident tag by selecting one or more values from a list defined by your BigPanda administrator.
The closed list feature adds two new tag-type options: single-select and multi-select. Single-select tags allow you to select one value from a closed list, while multi-select tags allow you to select multiple values.
For more information about tag types, see Incident Tag Types.
Add or Edit Tag Values in the Incidents Tab
Incident tags are added to all incoming incidents. Depending on your organization’s configuration, they may already be populated with automatic tag values, or they may be empty. You’re able to add or edit tag values to update the incident with the latest information about the ongoing issue.
Not all tags can be edited. During configuration, administrators can lock a tag to prevent manual editing.
If a tag cannot be manually changed, a lock icon will appear to the right of the incident tag.
Closed-list tags can be single-select or multi-select and will have a preset dropdown.
For single-select tags, select one item from the dropdown. For multi-select tags, select any number of items from the dropdown. For either tag type, you can type to filter the dropdown list.
See Add Tag Values to Incidents for more information.
Create a Closed-list Tag
Administrators can create new incident tags and add them to incidents in your system at any time.
List Tag Configuration
To create a closed-list incident tag:
- Navigate to Settings > Incident Enrichment.
- Click New Incident Tag.
- Under tag Type, select List.
- Choose from the Closed List of Values that appear in the dropdown. To add an additional value, click New Item.
- Enter your tag information, including the list of values, in the Tag Options.
- When satisfied with your tag settings, select Create Tag.
You’ll be prompted to configure a list of values in addition to the other tag options.
Each value is a single text string up to 256 characters. Each enrichment rule may have up to 1000 values listed.
At least one value must be included for a closed-list tag. You can search items currently added to the list by name or description.
When using closed-list tags, automatic enrichment values must match one or more of the items within the closed list.
Manage Closed-List Tags
You can edit, temporarily deactivate, or permanently delete closed-list incident tag values in the Manage Incident Enrichment page.
Caution When Changing Value Options
Incident tags drive automation and incident management across BigPanda. Changing value options may affect other configurations such as environments and their related sharing. When updating values, especially when removing an option, make sure to update all configuration elements that rely on the tag.
If you update or remove an option from the defined list, the original value will still appear on incidents that have been enriched with that value. If the incident is updated by new or changing alerts, the tag value will be removed. Operators will no longer be able to select the original value for incidents when manually updating tag values.
New API Fields
BigPanda Tag Definitions API
The Incident Tags Definitions API creates and updates incident tag rules and configuration.
If closed-list tags are enabled for your organization, you’ll be able to select PredefinedValuesMulti or PredefinedValuesSingle when configuring the type. In addition, you can leverage the Incident_tag_values and append_matching_items fields to configure the value options for the tag.
If you update or remove an option from the defined list, the original value will still appear on incidents that have been enriched with that value. If the incident is updated by new or changing alerts, the tag value will be removed. Operators will no longer be able to select the original value for incidents when manually updating tag values.
Incident Tag Definitions Object
Three fields of the Incident Tags Definition Object have been updated to support the new tag types. These changes only apply to closed-list tags, existing calls for priority or open text tags do not need to be changed.
| Attribute | Description | Type | Example |
|---|---|---|---|
| type | Incident tag definition's type. Can be one of: Text, MultiValue, Priority, ClosedListValuesMulti, ClosedListValuesSingle. (Required) | String | "type": "ClosedListValuesMulti" |
| config | Configuration object for the Priority type. (Required for Priority and Closed Lists) Attributes ordered_list - array of objects that define display and calculation settings for individual priority levels Incident_tag_values - array of strings that define the value options for a closed-list tag | Object | " |
| enrichment_config | Configuration object to add automatic enrichment to the incident tag. Attributes items - array of objects that define automatic enrichment rules for the incident tag append_matching_items - Whether the automatic enrichment will include the value of all matched conditions. When set to false, only the first matched value is applied. Required for closed-list multi-type tags. (Boolean) Default is false | Object |
BigPanda Incident Tags and Incidents V2 APIs
The Incident Tags API creates and updates incident tag values on incidents in BigPanda. The Incidents V2 API manages your incidents within BigPanda, including incident tag values.
Closed-list tag values can be managed as normal within the Incident Tags API. For closed-list tags, values sent through the API must match one of the value options configured on the tag. Values that do not match the list options will be dropped.
Example Create Multi-select Closet-list Tag
curl --request POST \
--url https://api.bigpanda.io/resources/v2.0/incidents/tags/definitions \
--header 'Authorization: Bearer <User API Key>' \
--header 'Content-type: application/json' \
--data '{
"name": "Runbook",
"type": "ClosedListValuesMulti",
"active": true,
"canManualInput": true,
"config": {
"incident_tag_values": [
{
"value": "https://www.samplerunbook.com"
},
{
"value": "https://www.alternaterubnook.com"
}
]
},
"enrichment_config": {
"append_matching_items": false,
"items": [
{
"value": "{alert_tags.url}",
"condition": "env = prd or lifecycle = prod"
}
]
}
}'
Learn more about how alerts suppressed by maintenance plans function in BigPanda in the Manage Planned Maintenance documentation.
Updated 8 months ago