BigPanda Standard Data Model (SDM) V2

ACTIVITY_COMMENT

Comment included with an activity.

VARCHAR

ACTIVITY_CREATOR_USER_ID

ID of the user responsible for the activity.

VARCHAR

ACTIVITY_ENVIRONMENT

Name of the environment where the activity took place.

VARCHAR

ACTIVITY_ID

Unique identifier of the activity.

VARCHAR

ACTIVITY_START_TIMESTAMP_UTC

UTC timestamp of when the activity started.

DATE_TIME

ACTIVITY_TYPE

Type of activity. One of: 

VARCHAR

ACTIVITY_USER_NAME

User name of the user responsible for the activity.

VARCHAR

ASSIGNEE_USER_NAME

User name of the user assigned to an incident

VARCHAR

INCIDENT_ID 

Unique identifier of the incident.

VARCHAR

SHARE_AUTO

Whether or not the incident was automatically shared.

BOOLEAN

SHARE_INTEGRATION_TYPE

Outbound integration type to which the incident was shared.

VARCHAR

SHARE_TARGET

Downstream incident response tool that received the incident.

VARCHAR

ALERT_DEDUP_KEY

Field used to identify duplicate incoming alerts. Uses either a combination of Primary and Secondary properties or a direct incident identifier.

VARCHAR

ALERT_DESCRIPTION

Detailed explanation of why an alert was triggered, offering more characters than other BigPanda tags.

VARCHAR

ALERT_DURATION_MINS

Duration of the alert, in minutes.

INT64

ALERT_END_TIMESTAMP_UTC

UTC timestamp of when the alert ended.

DATE_TIME

ALERT_HAS_MAINTENANCE

Whether the alert was ever suppressed by a maintenance plan.

BOOLEAN

ALERT_HIGHEST_STATUS

Highest status that the alert ever achieved.

VARCHAR

ALERT_ID 

Unique identifier of the alert.

VARCHAR

ALERT_PREV_START_TIMESTAMP_UTC

UTC timestamp of when an alert last fired.

DATE_TIME

ALERT_PRIMARY_PROPERTY_KEY

Primary key for unique alert identification in BigPanda; helps define deduplication keys and influences alert display.

This field often aligns with the secondary property and can be the same as the ALERT_DEDUP_KEY, but is adjustable for deduplication. 

VARCHAR

ALERT_RESOLUTION_TYPE

Defines how an alert was resolved, indicating whether it was through manual actions (via API or UI), automatic processes, or external systems.

Common values include manual-api, manual-ui, resolved, external-api, auto-resolve, and unresolved.

VARCHAR

ALERT_SECONDARY_PROPERTY_KEY

Secondary key for unique alert identification in BigPanda; helps define deduplication keys.

VARCHAR

ALERT_START_TIMESTAMP_UTC

UTC timestamp of when an alert first opened in BigPanda.

DATE_TIME

ALERT_STATUS

Current status of an alert. One of: OK, Critical, Warning.

VARCHAR

ALERT_UPDATED_TIMESTAMP_UTC

UTC timestamp of the last time an alert had an update.

DATE_TIME

BP_ALERT_QUALITY

Quality of alerts calculated by BigPanda using normalized tags.

Possible categories include:

High Quality Alerts: The most actionable type of alert with all important data needed for a team to triage and resolve the alert. High quality alerts usually include data on both technical and business context.

Medium Quality Alerts: An alert that contains the minimum level of information and technical context to support operator action. These alerts lack some valuable elements such as business context, dependencies, or resolution steps.

Low Quality Alerts: Alerts that lack key information or which were identified as irrelevant or misconfigured.

VARCHAR

EVENT_COUNT

Total number of events within an alert.

The event count number is calculated before deduplication and event marshaling.

INT64

INCIDENT_ID 

Unique identifier of the BigPanda incident. Key used to connect the incident table.

VARCHAR

INTEGRATION_TYPE

Integration type that sent events to BigPanda.

VARCHAR

IS_PRIMARY_ALERT

Whether the alert is the primary alert.

BOOLEAN

IS_PRIMARY_MANUALLY_SET

Whether the primary alert was manually set.

BOOLEAN

SOURCE_SYSTEM

Monitoring system that sent the alert.

VARCHAR

ALERT_ID

Unique identifier of the BigPanda alert.

VARCHAR

Alert tags

String value of an alert tag, defined by the column name.

The alert tags listed in Analytics reporting are dynamic and depend on your organization’s enrichment tags.

Alert tags always start with an underscore (_)

Each tag will have its own value column.

For example, you may see columns for host, app_tier, escalation_team, alert_category, etc.

VARCHAR

CHANGE_CREATED_TIMESTAMP_UTC

UTC timestamp of when the change was created.

DATE_TIME

CHANGE_DURATION_MINUTES

Duration of the change in minutes.

INT64

CHANGE_END_TIMESTAMP_UTC

UTC timestamp of when the change ended.

DATE_TIME

CHANGE_ID 

Unique identifier of the change, created by BigPanda.

VARCHAR

CHANGE_IDENTIFIER

Identifies unique changes sent to BigPanda from a source system.

VARCHAR

CHANGE_INTEGRATION_TYPE

Type of integration used to connect the change source system to BigPanda.

VARCHAR

CHANGE_SOURCE_SYSTEM

Change management system sending change events to BigPanda.

VARCHAR

CHANGE_START_TIMESTAMP_UTC

UTC timestamp of when the change started.

DATE_TIME

CHANGE_STATUS

Status of the change. One of:

VARCHAR

CHANGE_SUMMARY

High-level summary of the change captured from the source system.

VARCHAR

CHANGE_TICKET_URL

Direct URL to the source change system ticket.

VARCHAR

CHANGE_TOTAL_EVENTS

Count of distinct change events compressed into a single change in BigPanda

INT64

CHANGE_UPDATED_TIMESTAMP_UTC

UTC timestamp indicating when the change last updated with a change event. 

DATE_TIME

CHANGE_EVENTS_COUNT

Count of distinct change events compressed into a single change in BigPanda.

INT64

CHANGE_EVENTS_UPDATED_DATE

Date when this batch of change events was last updated for the parent change. 

DATE_TIME

CHANGE_ID

Unique change identifier created by BigPanda.

VARCHAR

ENRICHMENT_ALERT_ID

Unique identifier of the enriched alert.

VARCHAR

ENRICHMENT_ID 

Unique identifier for a single alert enrichment application in BigPanda.

VARCHAR

ENRICHMENT_MAP_UPDATE_TIMESTAMP_UTC

UTC timestamp of when the enrichment map was last updated.

DATE-TIME

ENRICHMENT_NAME

Name of the enrichment rule or enrichment map applied to the alert. 

VARCHAR

ENVIRONMENT_ID

Unique identifier for a single alert enrichment application in BigPanda.

VARCHAR

ENVIRONMENT_NAME

Name of the enrichment rule or enrichment map applied to the alert. Sourced from the enrichment configuration in BigPanda.

VARCHAR

INCIDENT_ID

Unique identifier of the incident.

VARCHAR

ALERT_ID 

Unique identifier of the alert.

VARCHAR

CREATED_AT

Time when the event was created.

DATE_TIME

EVENT_COUNT

Total number of events within an alert.

INT64

EVENT_STATUS

The event process status.

VARCHAR

INCIDENT_ID 

Unique identifier of the incident.

VARCHAR

IS_ALERTS

Whether the event row is associated with an alert. 

BOOLEAN

IS_INCIDENTS

Whether the event row is associated with an incident. 

BOOLEAN

SOURCE_SYSTEM

The human-entered name of the observability tool sending events to BigPanda.

VARCHAR

AUTO_SHARE_COUNT

Number of times an incident was AutoShared.

INT64

BP_INCIDENT_CLOSURE

Categorizes incident resolution methods in BigPanda, detailing how operations teams handle and resolve issues. 

Based on actions, incidents are categorized as:

VARCHAR

BP_INCIDENT_OUTLIER

Identifies incidents as outliers based on BigPanda's MTTx metric logic: assign time over a day, engage time over a day, or resolution time over a week. 

VARCHAR

BP_INCIDENT_RESOLUTION_BUCKET

Incidents are placed in resolution buckets depending upon the time to resolve.

Resolution buckets include the following:

VARCHAR

CORRELATION_PATTERN

Correlation pattern used to correlate alerts into the incident.

VARCHAR

CORRELATION_PATTERN_WINDOW

Time window for correlation patterns in incidents.

DOUBLE

FIRST_ACTION_TIMESTAMP_UTC

UTC timestamp marking when an incident was first actioned.

DATE_TIME

FIRST_ACTION_TYPE

Initial action taken to progress an incident, categorized as assign, comment, or share.

VARCHAR

FIRST_AIA_TIMESTAMP_UTC

UTC timestamp of when the first AIA action took place on the incident.

DATE_TIME

FIRST_MANUAL_ACTIVITY_TIMESTAMP_UTC

UTC timestamp of when the first manual action on the incident took place.

DATE_TIME

FIRST_MANUAL_ACTIVITY_TYPE

The type of action first manually taken on the incident.

VARCHAR

FIRST_MANUAL_ACTIVITY_USER_NAME

The name of user who performed the first manual action on the incident.

VARCHAR

FIRST_MANUAL_SHARE_TIMESTAMP_UTC

UTC timestamp of when the incident was first manually shared.

DATE_TIME

FLAPPING_STATE

Whether or not the related incident is flapping.

VARCHAR

HAS_SUGGESTED_CHANGE

Whether or not the incident has a suggested change.

BOOLEAN

INCIDENT_CREATED_TIMESTAMP_UTC

UTC timestamp when the incident was created.

DATE_TIME

INCIDENT_END_TIMESTAMP_UTC

UTC time when the incident ended.

DATE_TIME

INCIDENT_HIGHEST_STATUS

Highest status the incident achieved.

VARCHAR

INCIDENT_HYPERLINK

URL link to the BigPanda incident.

VARCHAR

INCIDENT_ID 

Unique ID of the BigPanda incident.

VARCHAR

INCIDENT_NUM_OF_ALERTS

Number of alerts in the incident.

INT64

INCIDENT_START_TIMESTAMP_UTC

UTC timestamp when the incident started.

DATE_TIME

INCIDENT_STATUS

Current incident status in BigPanda. 

VARCHAR

INCIDENT_UPDATED_TIMESTAMP_UTC

UTC timestamp when the incident was last updated.

DATE_TIME

IS_ACTIONED

Whether the incident was actioned.

BOOLEAN

IS_AIA

Whether AIA was invoked on an incident.

BOOLEAN

MANUAL_CORRELATION

Indicates manual intervention in incidents via split or merge actions, deactivating correlation patterns. 

True if splits or merges occur or the activity type is Merge or Split, otherwise False. 

VARCHAR

TIME_TO_ASSIGN_MINS

Amount of time it took to assign the incident, in minutes.

DOUBLE

TIME_TO_ENGAGE_MINS

Time in minutes from incident start to first engagement

DOUBLE

TIME_TO_RESOLVE_MINS

Amount of time it took to resolve the incident, in minutes.

DOUBLE

TIME_TO_SHARE_MINS

Amount of time it took to first share the incident, in minutes.

DOUBLE

TOTAL_MERGES

Count of incidents merged into each other.

INT64

TOTAL_SPLIT

Count of incidents split from a primary incident.

INT64

INCIDENT_ID 

Unique identifier of the incident

VARCHAR

_ITD_AI_REASONING_1

Reasoning behind the AI summary.

VARCHAR

_ITD_AI_ROOT_CAUSE_1

Root cause from the AI summary.

VARCHAR

_ITD_AI_SUMMARY_1

AIA Summary.

VARCHAR

_ITD_AI_TITLE_1

Title from the AI summary.

VARCHAR

_ITD_PRIORITY_1

Priority generated in the AI summary.

VARCHAR

AFFECTED_SERVICE

IT or business service impacted by the ticket. 

VARCHAR

ASSIGNED_TO

Individual user currently assigned to work on the ticket. Changes each time the ticket is reassigned.

VARCHAR

ASSIGNMENT_GROUP

Support team or functional group responsible for resolving the ticket. 

VARCHAR

BP_INCIDENT

BigPanda incident ID linked to this ticket via the BigPanda-ITSM integration.

VARCHAR

BRAND_CATEGORY

Customer-specific classification that categorizes tickets by business brand, product line, or organizational division.

VARCHAR

BUSINESS_DURATION

Elapsed business-hours duration of the ticket, stored as a timestamp offset.

DATE-TIME

BUSINESS_DURATION_DISPLAY_VALUE

Human readable display of the business hours duration for the ticket. Calculated using the customer's SLA schedule, excluding time in on-hold or paused states. 

VARCHAR

BUSINESS_IMPACT

Assessed level of business impact caused by the ticket. 

VARCHAR

CALLER_ID

ID of the person who reported or requested the ticket.

VARCHAR

CATEGORY

Primary topic classification of the ticket.

VARCHAR

CAUSED_BY_CHANGE

Identifies if the root cause of the incident was related to a change.

VARCHAR

CLOSE_CODE

Resolution code selected by the user when they closed the ticket. 

VARCHAR

CLOSE_NOTES

Free-text notes entered by the resolver when closing the ticket, documenting the resolution steps taken, root cause findings, or final status. 

VARCHAR

CMDB_CI

Configuration item associated with the ticket’s ITSM CMDB. 

VARCHAR

CONTACT_TYPE

Channel through which the ticket was reported.

VARCHAR

DESCRIPTION

Full detailed description of the ticket, either auto-populated by BigPanda, from the monitoring tools, or manually input by the ticket opener.

VARCHAR

IMPACT

Impact classification used in priority matrix calculation.

VARCHAR

ITSM_CONNECTOR_TIMESTAMP_UTC

UTC timestamp of the last data synchronization from the ITSM system via the BigPanda connector.

VARCHAR

ITSM_CONNECTOR_TYPE

Type of BigPanda integration connector used to ingest this ticket, or a native integration type.

VARCHAR

ITSM_ENDED_TIMESTAMP_UTC

UTC time when the incident ended.

DATE_TIME

ITSM_ID

The source ITSM system’s internal record identifier for the ticket.

VARCHAR

ITSM_NUMBER

Human-readable ticket number from the source ITSM system.

VARCHAR

ITSM_SOURCE_NAME

Name of the ITSM platform instance that generated this ticket.

VARCHAR

ITSM_STARTED_TIMESTAMP_UTC

UTC time when the incident started.

DATE_TIME

ITSM_UPDATED_TIMESTAMP_UTC

UTC time when the incident was last updated.

DATE_TIME

MADE_SLA

Whether the ticket was resolved within the target SLA timeframe.

BOOLEAN

MAJOR_INCIDENT_STATE

Whether the incident was defined as major.

VARCHAR

OPENED_BY

User who created the ticket record in the ITSM system.

VARCHAR

OPENED_BY_TYPE

Whether the ticket was opened by BigPanda, an automated system, or a human.

VARCHAR

PARENT_INCIDENT

Ticket number of a parent incident if this ticket is tracked as a child ticket. Used to group related tickets under a single parent.

VARCHAR

PRIORITY

Calculated priority of the ticket, commonly derived from the intersection of Impact and Urgency in the priority matrix.

VARCHAR

PROBLEM_ID

Problem record ID linked to this ticket, indicating the ticket is associated with a known problem.

VARCHAR

REASSIGNMENT_COUNT

Number of times the ticket was reassigned to a different group or individual during its lifecycle.

VARCHAR

REOPEN_COUNT

Number of times the ticket was reopened after being resolved or closed.

VARCHAR

RESOLVED_BY

User or system that resolved the ticket, recorded when the ticket transitions to a resolved state.

VARCHAR

SHORT_DESCRIPTION

Concise one line summary of the ticket, typically visible in list views and dashboards.

VARCHAR

STATE

Current lifecycle state of the ticket in the ITSM workflow, such as New, In Progress, On Hold, Resolved, or Closed.

VARCHAR

SUBCATEGORY

Secondary classification beneath the CATEGORY field.

VARCHAR

TTR_SECONDS

Time to resolve the ticket measured in seconds, calculated from ticket creation to resolution in the ITSM system.

INT64

URGENCY

Urgency classification indicating how quickly the issue needs to be addressed.

VARCHAR

WORK_NOTES

Internal notes added by support staff during the ticket lifecycle, documenting troubleshooting steps, escalation actions, and status updates.

VARCHAR

MAINTENANCE_PLAN_CREATED_BY

User or system that created the maintenance plan in BigPanda.

VARCHAR

MAINTENANCE_PLAN_CREATED_TIMESTAMP_UTC

UTC timestamp when the maintenance plan was created.

DATE_TIME

MAINTENANCE_PLAN_DESCRIPTION

Detailed explanation of the maintenance plan, including context about the scheduled maintenance activities.

VARCHAR

MAINTENANCE_PLAN_END_TIMESTAMP_UTC

UTC timestamp when a maintenance window is scheduled to end.

DATE_TIME

MAINTENANCE_PLAN_FREQUENCY

Frequency or recurrence pattern of the maintenance plan.

VARCHAR

MAINTENANCE_PLAN_ID

Unique identifier of the BigPanda maintenance plan.

VARCHAR

MAINTENANCE_PLAN_KEY

Human-readable identifier for the maintenance plan.

VARCHAR

MAINTENANCE_PLAN_NAME

Descriptive name for a maintenance plan, identifying the purpose or scope of the scheduled maintenance window.

VARCHAR

MAINTENANCE_PLAN_START_TIMESTAMP_UTC

UTC timestamp marking when a maintenance window is scheduled to begin.

DATE_TIME

SUPPRESS_ALERT_ID

Unique identifier of the suppressed alert.

VARCHAR

LOGIN_SESSION_ID

Unique identifier for a single user login session in BigPanda.

VARCHAR

LOGIN_TIMESTAMP

UTC timestamp when the user logged in.

DATE-TIME

LOGIN_USER_ID

Unique ID of the user who logged in.

VARCHAR

CHANGE_CATEGORY

RCC category that aligns with the change suggestion.

VARCHAR

CHANGE_CATEGORY_VALUE

RCC value that aligns with change match logic, detailing the specific match value driving change suggestions.

VARCHAR

CHANGE_ID 

Unique identifier of the change, assigned by BigPanda.

VARCHAR

CHANGE_MATCH_CERTAINTY

Confidence in matching the change to an incident.

VARCHAR

CHANGE_MATCH_USER_NAME

Name of the user who performed a manual match action.

VARCHAR

CHANGE_SCORE

Suspected change causation score indicates the strength of the relationship between a change and an incident, calculated by BigPanda.

DOUBLE

CHANGE_SUGGESTED_BY_BIGPANDA

Indicates whether a change suggestion was initiated by BigPanda

BOOLEAN

INCIDENT_ID

Unique identifier of the incident.

VARCHAR

USER_CREATED_TIMESTAMP_UTC

UTC timestamp indicating when the user was created in BigPanda.

DATE_TIME

USER_DELETED

Whether or not the user was deleted.

BOOLEAN

USER_EMAIL

Email address of the user.

VARCHAR

USER_FIRST_LOGIN_TIMESTAMP_UTC

UTC timestamp of when the user first logged in.

DATE_TIME

USER_ID

Unique identifier of the user.

VARCHAR

USER_LAST_LOGIN_TIMESTAMP_UTC

UTC timestamp of the last time the user logged in.

DATE_TIME

USER_NAME

The user's name.

VARCHAR

USER_ROLES

BigPanda roles assigned to the user.

VARCHAR

CREATED_AT

Time when the user role was created.

DATE-TIME

CREATED_BY

User who created the role.

VARCHAR

ROLE_ID

Unique identifier of the role.

VARCHAR

ROLE_NAME

Name of the role.

VARCHAR

UPDATED_AT

Time when the role was last updated.

DATE-TIME

USER_ID 

Unique identifier of the user who has the role.

VARCHAR

EXECUTION_ID

Unique identifier of the recommendation.

VARCHAR

INCIDENT_ID

BigPanda incident for which the recommendation was generated.

VARCHAR

RESOURCE_ID

Identifier of the resource the recommendation targets (For example, the ITSM ticket).

VARCHAR

RESOURCE_TYPE

Type of the targeted resource.

VARCHAR

RECOMMENDATION_TRIGGER_TYPE

What triggered the recommendation.

VARCHAR

RECOMMENDATION_AGENT_VERSION

Version of the recommendation agent that produced the output.

VARCHAR

RECOMMENDATION_LATENCY_MS

The time the agent took to produce the recommendation in milliseconds.

INT64

RECOMMENDATION_SUCCESS

Whether the recommendation run was completed successfully.

BOOLEAN

RECOMMENDATION_ERROR

Error detail when the run failed.

VARCHAR

SHOULD_SNOOZE

Whether the agent recommended snoozing the incident.

BOOLEAN

SNOOZE_TIME_MINUTES

Recommended snooze duration, in minutes.

INT64

SHOULD_HAVE_BEEN_SUPPRESSED

Whether it was recommended that the incident be been suppressed.

BOOLEAN

SUPPRESSION_VERDICT_REASONING

Reasoning behind the suppression verdict.

VARCHAR

RECOMMENDED_ASSIGNMENT_GROUP

Assignment group recommended for the incident.

VARCHAR

RECOMMENDED_ASSIGNMENT_GROUP_REASONING

Reasoning behind the recommended assignment group.

VARCHAR

RECOMMENDATION_OPTIONS

Full set of recommendation options produced.

VARCHAR

RECOMMENDATION_EVIDENCE_SOURCES

Evidence sources drawn from for recommendations.

VARCHAR

RECOMMENDATION_SIMILAR_INCIDENTS

Similar incidents referenced in the recommendation.

VARCHAR

RECOMMENDATION_DISPLAY_MESSAGE

Human-readable recommendation message shown to operators.

VARCHAR

SIMILAR_INCIDENTS_COUNT

Number of similar incidents found.

INT64

HAS_SIMILAR_INCIDENTS

Whether any similar incidents were found.

BOOLEAN

TOP_SIMILAR_INCIDENT_ASSIGNMENT_GROUP

Assignment group of the most similar past incident.

VARCHAR

TOP_SIMILAR_INCIDENT_SIMILARITY

Similarity score of the top matching incident.

DOUBLE

ASSIGNMENT_GROUP_OPTION_1

First-ranked recommended assignment-group option.

VARCHAR

ASSIGNMENT_GROUP_OPTION_2

Second-ranked recommended assignment-group option.

VARCHAR

ASSIGNMENT_GROUP_OPTION_3

Third-ranked recommended assignment-group option.

VARCHAR

RECOMMENDED_EVIDENCE_SOURCES_SUMMARY

Summary of the evidence sources behind the recommendation.

VARCHAR

IS_FIRST_EXECUTION

Whether this is the first agent execution for the incident.

BOOLEAN

RESOLVER_ASSIGNMENT_GROUP

Assignment group that resolved the incident.

VARCHAR

IS_EVALUABLE

Whether the recommendation can be evaluated against the actual resolver (requires ITSM resolution data).

BOOLEAN

RESOLVER_HIT_EXACT

Whether the recommended assignment group exactly matched the resolving group.

BOOLEAN

RESOLVER_SIMILARITY

Similarity between the recommended group and the actual resolving group.

DOUBLE

RESOLVER_ACCURACY_BUCKET

Bucketed accuracy of the recommendation versus the actual resolver.

VARCHAR

META__PROCESSING_TIME

Pipeline processing timestamp for the record.

DATE_TIME

META__RECORD_TIME

Source record timestamp.

DATE_TIME

METERING_EVENT_ID

Unique identifier of the metering event.

VARCHAR

METERING_STAGE

Agent pipeline stage of the metering event.

VARCHAR

AGENT_OUTPUT_TYPE

Type of output the agent produced at this stage.

VARCHAR

AGENT_OUTPUT

The agent's output payload.

VARCHAR

AGENT_OUTPUT_ID

Identifier of the agent output.

VARCHAR

AUTOMATION

Automation associated with the agent output.

VARCHAR

CALLER

System or component that invoked the agent.

VARCHAR

INCIDENT_ID

Incident the event relates to.

VARCHAR

LLM_TRACE_ID

Trace identifier of the underlying LLM call.

VARCHAR

EVENT_TIME

Timestamp of the event.

DATE_TIME

FEEDBACK_ID

Unique identifier of the feedback record.

VARCHAR

INCIDENT_ID

Incident associated with the feedback.

VARCHAR

EXECUTION_ID

Recommendation associated with the feedback.

VARCHAR

ENVIRONMENT_ID

Environment the incident belongs to.

VARCHAR

FEEDBACK_AGENT_TYPE

Which agent surface received the feedback.

VARCHAR

FEEDBACK_ASSIGNMENT_GROUP

Assignment group associated with the feedback.

VARCHAR

FEEDBACK_INTEGRATION_SYSTEM_ID

Source integration or system identifier for the feedback.

VARCHAR

FEEDBACK_IS_HELPFUL

Whether the operator marked the agent output helpful.

BOOLEAN

FEEDBACK_REASON

Reason the operator gave for the feedback.

VARCHAR

FEEDBACK_TYPE

Category of feedback.

VARCHAR

FEEDBACK_USER_ID

ID of the user who gave the feedback.

VARCHAR

FEEDBACK_USER_NAME

Name of the user who gave the feedback.

VARCHAR

FEEDBACK_EVENT_TIMESTAMP_UTC

UTC timestamp when the feedback was given.

DATE_TIME

USER_ID

Unique identifier of the user.

VARCHAR

USER_EMAIL

Email address of the user.

VARCHAR

USER_TITLE

Job title of the user.

VARCHAR

USER_ROLE

Role of the user.

VARCHAR

USER_TEAM_ID

Identifier of the user's team.

VARCHAR

USER_TEAM_NAME

Name of the user's team.

VARCHAR

USER_HAS_USED_BIGGY

Whether the user has used Biggy.

BOOLEAN

USER_INFORMED_OF_ONBOARDING

Whether the user has been informed of onboarding.

BOOLEAN

USER_ONBOARDING_CURRENT_STEP

Current step in the user's onboarding flow.

VARCHAR

USER_ONBOARDING_IS_COMPLETED

Whether the user completed onboarding.

BOOLEAN

USER_ONBOARDING_QUERY_ALLOWANCE_WINDOW_TIMESTAMP_UTC

UTC timestamp of the user's onboarding query allowance window.

DATE_TIME

USER_FIRST_QUERY_RUN

Whether the user has run their first query.

BOOLEAN

USER_FIRST_QUERY_FEEDBACK

Feedback the user gave on their first query.

VARCHAR

USER_SECOND_QUERY_RUN

Whether the user has run their second query.

BOOLEAN

USER_SECOND_QUERY_FEEDBACK

Feedback the user gave on their second query.

VARCHAR

USER_SLACK_TEAM_ID

Slack team (workspace) ID for the user.

VARCHAR

USER_SLACK_USER_ID

Slack user ID.

VARCHAR

USER_MS_TEAMS_TENANT_ID

Microsoft Teams tenant ID for the user.

VARCHAR

USER_MS_TEAMS_USER_ID

Microsoft Teams user ID for the user.

VARCHAR

USER_CREATED_TIMESTAMP_UTC

UTC timestamp when the user record was created.

DATE_TIME

USER_UPDATED_TIMESTAMP_UTC

UTC timestamp when the user record was last updated.

DATE_TIME

MIM_EXECUTION_ID

Unique identifier of the MIM execution.

VARCHAR

MIM_EXECUTION_STATUS

Current status of the MIM execution.

VARCHAR

MIM_TEMPLATE_ID

Identifier of the MIM template used.

VARCHAR

MIM_TEMPLATE_NAME

Name of the MIM template used.

VARCHAR

INCIDENT_ID

Incident the MIM execution ran against.

VARCHAR

ENVIRONMENT_ID

Environment of the incident.

VARCHAR

INCIDENT_TITLE

Title of the incident at execution time.

VARCHAR

INCIDENT_PRIORITY

Priority of the incident.

VARCHAR

INCIDENT_ENVIRONMENT

Environment name of the incident.

VARCHAR

INCIDENT_REGION

Region of the incident.

VARCHAR

MIM_EXECUTION_IS_DEMO

Whether the execution was a demo.

BOOLEAN

MIM_EXECUTION_IS_DELETED

Whether the execution was deleted.

BOOLEAN

MIM_EXECUTION_CALLER_SYSTEM

System that initiated the execution.

VARCHAR

MIM_EXECUTION_CALLER_COMPONENT

Component that initiated the execution.

VARCHAR

MIM_EXECUTION_CREATED_BY_USER_NAME

Name of the user who created the execution.

VARCHAR

MIM_EXECUTION_CREATED_BY_USER_ID

ID of the user who created the execution.

VARCHAR

MIM_EXECUTION_CREATED_BY_SLACK_USER_ID

Slack user ID of the MIM execution creator.

VARCHAR

MIM_EXECUTION_RESOLVE_OUTCOME_KIND

Kind of resolution outcome for the execution.

VARCHAR

MIM_EXECUTION_RESOLVE_INITIATED_BY_NAME

Name of the person who initiated resolution.

VARCHAR

MIM_EXECUTION_SLACK_TEAM_ID

Slack team ID for the execution.

VARCHAR

MIM_EXECUTION_TEAMS_TENANT_ID

Microsoft Teams tenant ID for the execution.

VARCHAR

MIM_EXECUTION_CREATED_TIMESTAMP_UTC

UTC timestamp when the execution was created.

DATE_TIME

MIM_EXECUTION_UPDATED_TIMESTAMP_UTC

UTC timestamp when the execution was last updated.

DATE_TIME

MIM_EXECUTION_CLOSED_TIMESTAMP_UTC

UTC timestamp when the execution was closed.

DATE_TIME

MIM_EXECUTION_EXPIRES_TIMESTAMP_UTC

UTC timestamp when the execution expires.

DATE_TIME

MIM_EXECUTION_DELETED_TIMESTAMP_UTC

UTC timestamp when the execution was deleted.

DATE_TIME

MIM_TEMPLATE_ID

Unique identifier of the MIM template.

VARCHAR

MIM_TEMPLATE_NAME

Name of the MIM template.

VARCHAR

MIM_TEMPLATE_DESCRIPTION

Description of the MIM template.

VARCHAR

MIM_TEMPLATE_IS_ENABLED

Whether the MIM template is enabled.

BOOLEAN

MIM_TEMPLATE_IS_DEFAULT

Whether this is the default MIM template.

BOOLEAN

MIM_TEMPLATE_IS_DELETED

Whether the MIM template was deleted.

BOOLEAN

MIM_STATUS_SYNC_ENTITY_ID

Entity ID used to sync MIM status.

VARCHAR

MIM_TEMPLATE_SWARM_INVESTIGATION_ELIGIBILITY

Eligibility of the MIM template for swarm investigation.

VARCHAR

MIM_TEMPLATE_PRIORITY_STATIC_VALUE

Static priority value assigned by the MIM template.

VARCHAR

MIM_TEMPLATE_PRIORITY_VALUE_SOURCE

Source of the MIM template's priority value.

VARCHAR

MIM_TEMPLATE_STATUS_PAGE_ENABLED

Whether a status page is enabled for the template.

BOOLEAN

MIM_TEMPLATE_STATUS_PAGE_DEFAULT_VIEW

Default view of the status page.

VARCHAR

MIM_TEMPLATE_STATUS_PAGE_TEMPLATE_ID

Identifier of the status page template.

VARCHAR

MIM_TEMPLATE_STATUS_PAGE_AUTO_UPDATE_FREQUENCY_MINUTES

Auto-update frequency of the status page, in minutes.

INT64

MIM_TEMPLATE_CREATED_TIMESTAMP_UTC

UTC timestamp when the MIM template was created.

DATE_TIME

MIM_TEMPLATE_UPDATED_TIMESTAMP_UTC

UTC timestamp when the MIM template was last updated.

DATE_TIME

MIM_TEMPLATE_DELETED_TIMESTAMP_UTC

UTC timestamp when the MIM template was deleted.

DATE_TIME

REPORT_ID

Unique identifier of the report.

VARCHAR

REPORT_AUTHOR_USER_ID

ID of the user who created the report.

VARCHAR

REPORT_TITLE

Title of the report.

VARCHAR

REPORT_SUMMARY

Summary of the report.

VARCHAR

REPORT_MARKDOWN

Full report body in markdown.

VARCHAR

REPORT_EXECUTION_STATE

Execution state of the report generation.

VARCHAR

REPORT_CURRENT_STEP

Current step in report generation.

VARCHAR

REPORT_TICKET_COUNT

Number of tickets or incidents analyzed in the report.

INT64

REPORT_IS_DELETED

Whether the report was deleted.

BOOLEAN

REPORT_IS_FAVORITED

Whether the report is favorited.

BOOLEAN

REPORT_IS_ORG_SHARED

Whether the report is shared org-wide.

BOOLEAN

REPORT_CREATED_BY_IMPERSONATION

Whether the report was created via impersonation.

BOOLEAN

REPORT_HAS_DISTILLED_DATA

Whether the report includes distilled data.

BOOLEAN

REPORT_IS_CHUNKED_ANALYSIS

Whether the analysis was chunked.

BOOLEAN

REPORT_CREATED_TIMESTAMP_UTC

UTC timestamp when the report was created.

DATE_TIME

REPORT_UPDATED_TIMESTAMP_UTC

UTC timestamp when the report was last updated.

DATE_TIME

REPORT_EXECUTED_TIMESTAMP_UTC

UTC timestamp when the report generation ran.

DATE_TIME

REPORT_COMPLETED_TIMESTAMP_UTC

UTC timestamp when the report was completed.

DATE_TIME

REPORT_ID

Unique identifier of the report.

VARCHAR

REPORT_AUTHOR_USER_ID

ID of the user who authored the report.

VARCHAR

REPORT_TITLE

Title of the report.

VARCHAR

REPORT_SUMMARY

Summary of the report.

VARCHAR

REPORT_EXECUTION_STATE

Execution state of report generation.

VARCHAR

REPORT_CURRENT_STEP

Current step in report generation.

VARCHAR

REPORT_TICKET_COUNT

Number of tickets or incidents analyzed to create the report.

INT64

REPORT_IS_DELETED

Whether the report was deleted.

BOOLEAN

REPORT_IS_FAVORITED

Whether the report is favorited.

BOOLEAN

REPORT_IS_ORG_SHARED

Whether the report is shared org-wide.

BOOLEAN

REPORT_CREATED_BY_IMPERSONATION

Whether the report was created via impersonation.

BOOLEAN

REPORT_CREATED_TIMESTAMP_UTC

UTC timestamp when the report was created.

DATE_TIME

REPORT_UPDATED_TIMESTAMP_UTC

UTC timestamp when the report was last updated.

DATE_TIME

REPORT_EXECUTED_TIMESTAMP_UTC

UTC timestamp when the report generation ran.

DATE_TIME

REPORT_COMPLETED_TIMESTAMP_UTC

UTC timestamp when the report was completed.

DATE_TIME

WORKFLOW_EXECUTION_ID

Unique identifier of the workflow execution.

VARCHAR

WORKFLOW_NAME

Name of the workflow.

VARCHAR

WORKFLOW_TYPE

Type of the workflow.

VARCHAR

WORKFLOW_EXECUTION_APP_TYPE

App surface the workflow ran in.

VARCHAR

WORKFLOW_EXECUTION_FROM_INCIDENT_NOTIFICATION

Whether the execution was triggered from an incident notification.

BOOLEAN

WORKFLOW_EXECUTION_SLACK_CHANNEL_ID

Slack channel the workflow ran in.

VARCHAR

WORKFLOW_EXECUTION_SLACK_MESSAGE_TS

Slack message timestamp anchoring the execution.

VARCHAR

WORKFLOW_EXECUTION_TEAMS_CHANNEL_ID

Microsoft Teams channel the workflow ran in.

VARCHAR

WORKFLOW_EXECUTION_TEAMS_MESSAGE_ID

Microsoft Teams message ID of the execution.

VARCHAR

WORKFLOW_EXECUTION_DURATION_SECONDS

Duration of the workflow execution, in seconds.

INT64

WORKFLOW_EXECUTION_CREATED_TIMESTAMP_UTC

UTC timestamp when the execution was created.

DATE_TIME

WORKFLOW_EXECUTION_UPDATED_TIMESTAMP_UTC

UTC timestamp when the execution was last updated.

DATE_TIME

CHANGE_RISK_ASSESSMENT_ID

Unique identifier of the change risk assessment.

VARCHAR

CHANGE_IDENTIFIER

Source-system identifier of the change being assessed.

VARCHAR

CHANGE_RISK_PROFILE_ID

Risk profile applied to the assessment.

VARCHAR

CHANGE_RECORD_URL

URL to the source change record.

VARCHAR

SHORT_DESCRIPTION

Short description of the change.

VARCHAR

DESCRIPTION

Full description of the change.

VARCHAR

STATE

Lifecycle state of the change.

VARCHAR

PRIORITY

Priority of the change.

VARCHAR

IMPACT

Impact classification of the change.

VARCHAR

URGENCY

Urgency classification of the change.

VARCHAR

ASSIGNED_TO

User the change is assigned to.

VARCHAR

ASSIGNMENT_GROUP

Group responsible for the change.

VARCHAR

APPROVAL_STATUS

Current approval status of the change.

VARCHAR

APPROVAL_HISTORY

History of approval actions.

VARCHAR

DECLARED_RISK

Risk level declared on the change record.

VARCHAR

DECLARED_RISK_ANALYSIS

Analysis behind the declared risk.

VARCHAR

RISK_RATING

Overall risk rating for the change.

INT64

WORK_NOTE_FULL_SENT

Whether the full work note was sent back to the source.

BOOLEAN

CHANGE_PLAN

Implementation plan for the change.

VARCHAR

BACKOUT_PLAN

Backout or rollback plan for the change.

VARCHAR

TEST_PLAN

Test plan for the change.

VARCHAR

JUSTIFICATION

Business justification for the change.

VARCHAR

CMDB_CI

Configuration Item (affected service or asset) associated with the change.

VARCHAR

BUSINESS_SERVICE

Business service affected by the change.

VARCHAR

RISK_SCORE_BLENDED

Final blended risk score across all dimensions.

DOUBLE

RISK_SCORE_CUSTOM_EVAL

Risk score from custom evaluation.

DOUBLE

RISK_SCORE_HISTORICAL_INCIDENT

Risk score from historical incident analysis.

DOUBLE

RISK_SCORE_IMPLEMENTATION_COMPLEXITY

Risk score from implementation complexity.

DOUBLE

RISK_SCORE_TEAM_AND_INDIVIDUAL

Risk score from team or individual track record.

DOUBLE

RISK_SCORE_TOPOLOGICAL_IMPACT

Risk score from topological impact.

DOUBLE

RISK_WEIGHT_CUSTOM_EVAL

Weight applied to the custom evaluation category.

DOUBLE

RISK_WEIGHT_HISTORICAL_INCIDENT

Weight applied to the historical incident category.

DOUBLE

RISK_WEIGHT_IMPLEMENTATION_COMPLEXITY

Weight applied to the implementation complexity category.

DOUBLE

RISK_WEIGHT_TEAM_AND_INDIVIDUAL

Weight applied to the team or individual category.

DOUBLE

RISK_WEIGHT_TOPOLOGICAL_IMPACT

Weight applied to the topological impact category.

DOUBLE

CUSTOM_EVAL_CONFIDENCE

Confidence of the custom evaluation.

INT64

CUSTOM_EVAL_SUMMARY

Summary of the custom evaluation.

VARCHAR

INDIVIDUAL_NAME

Individual whose track record is scored.

VARCHAR

INDIVIDUAL_TOTAL_CHANGES

Total changes made by the individual.

INT64

INDIVIDUAL_TOTAL_INCIDENTS

Total incidents linked to the individual's changes.

INT64

INDIVIDUAL_PCT_CHANGES_CAUSE_INCIDENTS

Percent of the individual's changes that caused incidents.

DOUBLE

INDIVIDUAL_RISK_SCORE

Risk score for the individual.

DOUBLE

TEAM_NAME

Team whose track record is scored.

VARCHAR

TEAM_TOTAL_CHANGES

Total changes made by the team.

INT64

TEAM_TOTAL_INCIDENTS

Total incidents linked to the team's changes.

INT64

TEAM_PCT_CHANGES_CAUSE_INCIDENTS

Percent of the team's changes that caused incidents.

DOUBLE

TEAM_RISK_SCORE

Risk score for the team.

DOUBLE

LLM_INPUT_TOKENS

Input tokens consumed by the LLM assessment.

INT64

LLM_OUTPUT_TOKENS

Output tokens produced by the LLM assessment.

INT64

LLM_TOTAL_TOKENS

Total tokens used by the LLM assessment.

INT64

CHANGE_SCHEDULED_START_TIMESTAMP_UTC

UTC scheduled start of the change window.

DATE_TIME

CHANGE_SCHEDULED_END_TIMESTAMP_UTC

UTC scheduled end of the change window.

DATE_TIME

CHANGE_CREATED_TIMESTAMP_UTC

UTC timestamp when the change was created.

DATE_TIME

CHANGE_UPDATED_TIMESTAMP_UTC

UTC timestamp when the change was last updated.

DATE_TIME

ASSESSMENT_FIRST_ASSESSED_TIMESTAMP_UTC

UTC timestamp when the change was first assessed.

DATE_TIME

ASSESSMENT_CREATED_TIMESTAMP_UTC

UTC timestamp when the assessment was created.

DATE_TIME

ASSESSMENT_UPDATED_TIMESTAMP_UTC

UTC timestamp when the assessment was last updated.

DATE_TIME