Smart Defaults for Incident Tags

BigPanda now includes six configurable, system-generated incident tags by default to help you get started.


Enabling Smart Defaults

If you are interested in enabling this functionality for your organization, contact your BigPanda account team. All accounts created after April 4th 2024 will have this feature enabled by default.

Incident tags allow you to quickly see metadata for an incident without digging through the related alerts. These tags add contextual information, details, or other enrichment data sets to your incidents.

To make it easier to get the most out of incident tags, BigPanda now includes several configurable, system-generated incident tags by default. These tags are based on industry best practices and are designed to provide you with essential and actionable incident information.


If this feature is enabled for an organization created before April 5th 2024, the smart default tags will be inactive until toggled on. They have unique identifiers and will not interfere with existing tag schemas.

To view these default tags, navigate to Settings > Incident Enrichment. Default tags will have a purple badge to distinguish them from the incident tags you manually create.

Default tags can be edited or disabled, but they cannot be deleted.

Default incident tags

Default incident tags

FieldDescriptionUnique IDType
HostsName of the target system(s) that generated the alert.
Impacted CIsConfiguration items impacted by the incident.itd_impacted_cis_1Multi-value
Closure CodeExplanation of the incident's resolution. This single-select list pre-populates with these seven values, but can be edited to fit your use case:

Manually resolved by operator - Incident was closed in BigPanda by an operator.

Resolved w no action - No incident actions taken in BigPanda before resolution.

Resolved from source w action - Alert closed by an ‘ok’ event from the monitoring tool. One or more incident actions were taken in BigPanda before resolution.

Resolved from API - Incident resolved via an API call from an outbound integration.

Auto-resolved by BigPanda - Incident was resolved due to a Time Based Alert Resolution rule.

Caused by change - The resolved incident was generated by a change.

Other - Any resolution that doesn’t fit the above categories.
itd_closure_code_1List (Single-select)
Ticket LinkA link to the relevant ticket in your ITSM.itd_ticket_link_1Text
Assignment GroupsAssignment group(s) in the integrated outbound tool(s).
ApplicationsThe impacted application(s).itd_applications_1Multi-value
PriorityImportance or severity of the alert.itd_priority_1Priority


Automatic Values

If you want to automatically populate the values for these incident tags, you’ll need to configure Automatic Incident Tag Enrichment.

Default Incident Tags for AI

If your organization has AI features enabled, you’ll also see four AI-specific default tags.

FieldDescriptionUnique IDType
AI ReasoningExplanation of the logical path the AI traveled to suggest the root cause.itd_ai_reasoning_1Text
AI Root CauseThe timeline and context of alert events. Describes how these alert events might be related.itd_ai_root_cause_1Text
AI TitleA high level description of the incident.itd_ai_title_1Text
AI SummaryThe full alert data for the incident and summarizes key impact and situation changes for the incident.itd_ai_summary_1Text

Editing a Default Tag

Default tags are configurable so you can customize them to meet the needs of your organization.

Edit a default tag

Edit a default tag

To edit a default incident tag:

  • Navigate to Settings > Incident Enrichment. You’ll see the list of existing incident tags.
  • Select the incident tag you wish to edit, activate/deactivate, or delete.
  • Click the Pencil icon on the incident tag ribbon, or the Edit Incident Tag Details button in the incident tag details pane.
  • The Tag Editor opens, allowing you to make changes to the tag settings.
  • When satisfied with the tag settings, click Update Tag.


Editing Tag Configuration

To edit your default tag configuration, refer to the documentation for Creating Incident Tags.

To learn more about incident tags, read our documentation on Managing Incident Enrichment.