BigPanda can share any incident through email and SMS by default, without any configuration. You can configure additional sharing channels by integrating a target system with BigPanda. BigPanda provides built-in integrations to several types of systems, including:
Ticketing systems—such as JIRA and ServiceNow. BigPanda automatically populates the tickets with incident information, including a link to an Incident Preview Page, and keeps the external ticket up-to-date with the latest status of the BigPanda incident. In BigPanda, the incident shows the current status of the ticket in the target system and provides a direct link to it.
Messaging services—ie: Slack
Other task and incident management tools— such as Asana and PagerDuty.
Additionally, you can use the Notifications Webhook to build custom integrations with other messaging, ticketing, or collaboration systems.
Define AutoShare Rules to automatically share all BigPanda incidents in an Environment with the right people and teams in your organization. Common use cases include notifying the team that is responsible for an incident, triggering workflows in an external ticketing system, and escalating incidents automatically. For example, you can define an AutoShare rule that:
Sends an email to the DBA team for incidents related to production databases.
Creates a ticket in ServiceNow that triggers an assignment process.
Sends SMS notifications to the emergency contacts for critical alerts.
Manual sharing allows you to share an individual incident directly from the incident feed. For example, if you belong to a NOC or level-1 response team, you can share incidents to escalate them to their level-2/3 owners.
BigPanda sends information to subscribed recipients of a share when an incident is:
Shared manually—with the manually selected recipients.
Created—if the incident matches AutoShare rules.
Closed—all alerts in the incident are resolved.
Reopened—the incident had been closed, but is now reopened.
Flapping—the incident has entered a flapping state.
To reduce noise levels, BigPanda does not send updates for snoozed incidents and incidents in a flapping state (after the initial update that it is flapping).
When an incident is shared, BigPanda includes a link to the incident preview page, where recipients can see the latest incident status and unsubscribe from further updates for the incident.
To share incidents through channels such as JIRA, Slack, or PagerDuty, you must integrate the target system with BigPanda. Email and SMS sharing are built-in, and no configuration is required.
Obtain administrator access to BigPanda.
(Recommended) Review the Integrations Overview.
- At the top of the screen, click the Integrations tab.
- In the left pane, click New Integration.
- Click the Collaboration tab, and then click the desired integration. The installation instructions open.
- Follow the instructions to install and configure your integration.
Multiple Integrations for a Single System
You can integrate multiple accounts for the same target system. For example, different operations teams may use different projects within JIRA to track their issues.
Be sure to give the integration a descriptive name. You will use this name when defining AutoShare rules.
- At the top of the screen, click the Incidents tab.
- In the incident feed, click the Share icon () on any incident.
- For the sharing channel, select the target system you integrated.
- (Optional) Enter a personal message (for example, Testing).
- Click Share.
- Verify that the incident was sent to the target system as expected. Be sure to clean up any test data in the target system, as necessary.
You can automatically share incidents with key team members to ensure they have the information they need, when and how they need it, to assist in the resolution process. Configure AutoShare rules to share all incidents in an Environment through email, SMS, or any other sharing channel you have configured.
- In the top right, click the Settings icon (), and then click AutoShare.
- In the top right corner, click Create AutoShare.
- Select the Environment for which to share incidents, and select the sharing channel to use.
- Click Next. A window opens with options specific to the sharing channel you selected (such as recipients for an email AutoShare).
- Enter the relevant information.
- (Optional) Enter an annotation for the share. Consider adding an annotation that helps team members understand why the incident is AutoShared. The annotation appears in the activity feed when an incident in AutoShared.
- Click Create. The new AutoShare rule is added to the list.
Logic for AutoShare Rules
After you create a new AutoShare rule or activate a previously disabled rule, any new incidents are shared according to the rule. Existing incidents are not shared unless they are resolved and then reopen or enter a flapping state. For more information, see AutoShare Rules Logic.
You can edit, temporarily disable, or permanently delete AutoShare rules.
- In the top right, click the Settings icon (), and then click AutoShare.
- Locate the row of rule you want to change.
Searching for Rules
You can filter the list of rules by entering a search term in the field above the list. For example, enter Slack to see all of the AutoShare rules that use Slack as the sharing channel.
Use any of the following options to manage the rule:
- To edit the rule, click edit, and then modify the options available for that sharing channel.
To select a different Environment or sharing channel, you must create a new rule.
- To temporarily disable the rule, select Inactive in the Active column. Incidents are no longer shared via the rule. You can enable the rule by selecting Active.
- To permanently delete the rule, click delete, and then click Yes to confirm the deletion.
In your monitoring tool, trigger a mock alert that meets the Environment criteria for the AutoShare rule you created.
Verify that the incident was sent to the target system as expected. Be sure to clean up any test data in the target system and in BigPanda, as necessary.
AutoShare rules determine which incidents are automatically shared with which recipients. A new incident is shared automatically according to all the active rules that it matches. When you create a new AutoShare rule, new incidents are shared according to the rule but existing incidents are not shared. If an incident no longer matches a rule, it is no longer shared by the rule.
When a new incident is created, BigPanda shares it automatically according to any active AutoShare rules that it matches. The share is sent after an initial delay, which ensures that the message includes all the information a recipient needs to get a clear picture of the incident. For example, if multiple, simultaneous alerts are correlated into the incident, the initial delay ensures that the shared message includes information about all the related alerts. By default, the initial delay is 5 seconds.
Customizing The Delay
To use a custom duration for the initial delay, contact BigPanda support.
When you create a new AutoShare rule or activate a previously disabled rule:
New incidents are shared automatically according to the rule.
Existing incidents in the Environment are not shared automatically. However, if an existing incident is resolved and then is reopened or enters a flapping state, a share is sent.
If an existing incident no longer matches a rule, BigPanda stops sending updates for it. For example, if the incident status changes to Warning and therefore is no longer included in an Environment for critical incidents, the AutoShare rules for that Environment are no longer applied to the incident.
Exception For Ticketing Systems
When an AutoShare rule creates an auto-populated ticket in a target system, such as JIRA or ServiceNow, BigPanda continues to send updates to the ticket even if the incident no longer matches the Environment criteria.
If multiple rules match the same incident:
The incident is shared with all channels in all matching rules.
The incident is shared only one time per channel, per update. So, if the incident matches three different rules that email the same contact, the contact receives one email per update, not three.
The order of the AutoShare rules does not impact the sharing behavior.
For an AutoShare to JIRA, the JIRA ticket is populated with the Environment from one of the matching rules. The Environment is selected randomly from the matching rules.
Inactive rules do not impact active rules. For example, if a rule for the All Environment is set to Inactive, other active rules continue to AutoShare incidents as expected.
When BigPanda incidents are shared via email or SMS, the messages use a standard format to send information and updates.
BigPanda sends sharing email updates with the following format for the subject:
<User name> shared with you the incident:
<Incident subjects>/<Alerts summary>
BigPanda sends sharing email updates with the following format for the message body:
<User name> shared this incident with you.
Details as of:
<Last change to incident>
<Link to Incident>
<Incident start time>
<Source system>< - Integration name> (one entry for each source system)
<Link to incident preview page>
<Link to incident details>
<Link to incident timeline>
This incident contains:
(<Number of active alerts>) <Status of alerts>
(One entry for each active alert)``<Alert status>``<Alert source system> ``<Alert subject>
<Link to Incident>
Update Incident ID
The BigPanda link includes the unique incident ID number as the last 24 characters of the URL. When building custom, email-based integrations, you can parse the email for either the entire URL or the last 24 characters on the right, and use it as a unique key to help determine if the notification is for a new incident or for an update to an existing one.
BigPanda sends SMS sharing updates with the following message format:
<Incident status>``<Incident subjects>
<Link to BigPanda incident preview page>
Message Length Limits
BigPanda sends only one SMS message per incident update. To limit the length of the SMS message, the content of the incident subjects and alerts summary are limited to a maximum number of characters and may be truncated in the message.