Activities Object

Defines the schema for activity types within incidents in BigPanda

General Parameters

The Activity object includes the following attributes. Many activity types include additional parameters included in the schema.

Parameter

Description

Type

Example

id

System-generated unique identifier for the activity

String

"id": "60800a8012d7dd0464f1b87d"

type

The type of activity

String

"type" : "incident_created"

timestamp

Unix time when the activity occurred in system

Timestamp (in seconds)

"timestamp": 1466416853

created_by

User ID of the user who manually took action

String

"created_by":"234234234242892734"

params

Additional parameters according to the type

Object

"params": {
"share_target": "webhook.whtest",
"share_auto": false,
"escalation_id": "61f8e20e89325b001201b9a3",
"firstTime": true
}

Type-Specific Parameters

Each activity type has type-specific parameters included in the schema. These parameters will only be included for the relevant activity types.

Activity Type

Description

Additional Parameters

Example

incident_assigned

A specific user was assigned responsibility to see the incident through resolution

assignee object:
id - the unique ID of the user the incident was assigned to
username - the username of the user the incident was assigned to

"assignee": {
"id":
"5a3333e9e3affc7a70f2194d",
"username":
"[email protected]"
}

incident_become_flapping

The incident entered or exited the flapping state in which at least one correlated alert is changing states too frequently

flapping (true/false)

  • whether or not the incident is in the flapping state

"flapping": true,

incident_commented

A comment was added to the incident

comment - the comment string added to the incident

"comment": "An Example Comment"

incident_resolved_ui_manually

The incident was resolved by a user through the BigPanda UI

annotation - an optional comment added to the resolver action

"annotation": "An Example Comment"

incident_resolved_api

The incident was resolved by an API call

annotation - an optional comment added to the resolver action

"annotation": "An Example Comment"

incident_alerts_resolved

One or more of the alerts within the incident were manually resolved

annotation - an optional comment added to the resolver action
resolution_type - the method through which the alerts were resolved. One of: manual-ui, manual-api
ids_to_resolve - the unique id of the alerts that were resolved

"annotation": "An Example Comment"
"resolution_type": "manual-ui",
"ids_to_resolve": [ "3333397471c2c02e05fec666", "3333397471c2c02e05fec444"
]

incident_tag_removed

An incident tag was removed from the incident

tag_id - system-generated unique identifier for the incident tag

"tag_id": "itd_priority_1",

incident_tag_updated

An incident tag was added to the incident

tag_id - system-generated unique identifier for the incident tag
tag_value - the content of the incident tag

"tag_id": "itd_priority_1",
("timestamp": 1589742187193)
"tag_value": 800

incident_merged_destination

The incident was the destination of a merge action

source_incident_ids - A list of incidents that were merged into this destination incident

"source_incident_ids": [ "5fef495e55f63f465ce39b5a",
"5fef49c534735a46ccc87acc"
]

incident_merged_source

The incident was merged into a different incident

targetIncidentId - The destination incident this incident was merged into
source_incident_ids - A list of incidents to merge into the destination incident defined in the URL path

"targetIncidentId": "5fef49c829e14c2d52c5623c",
"source_incident_ids": [ "5fef495e55f63f465ce39b5a", "5fef49c534735a46ccc87acc"
]

incident_created

The incident was created in the system

None

incident_rcc_update

The relationship between the incident and a potential root cause change match was updated

change object:
identifier - he change's unique identifier from its original change system
ticket_url - the URL of the record in the change system
change_id - the unique identifier of the change in BigPanda
rcc_medata object:
change_id - the unique identifier of the change
updated_at - unix time of the last update to the change in BigPanda
match_certainty (MATCH, SUSPECT, or NONE) - the relationship status between the change and incident
match_type (manual-UI or Manual-API) - whether the relationship status between the change and incident was set by a user or the RCC algorithm
comment - an optional comment added to a manual match action
suggested_by_bigpanda (true/false) - whether the relationship status between the change and incident was suggested by BigPanda's RCC algorithm

"change": {
"identifier": "test-change",
"ticket_url":
"https://jira.link.com/ticket?change=chng123",
"change_id": "6107a18ee5f491b87f4491a7",
"rcc_metadata": {
"change_id": "6171100de5f491b87f6c3136",
"updated_at": "2021-10-21T07:00:29.256Z"
"match_certainty": "NONE",
"match_type": "MANUAL",
"comment": "An Example Comment",

"suggested_by_bigpanda": false
}
}

incident_shared

The incident was shared to an external channel

share_target - the channel or address the incident was sent to
share_auto (true/false) - whether the share was triggered by an AutoShare rule
escalation_id - an internal system id for the rule-match that triggers the share
annotation - an optional comment added to the share action
firstTime - whether or not this was the first time this incident was shared to the destination

"share_target": "webhook.whtest",
"share_auto": false,
"escalation_id": "61f8e20e89325b001201b9a3",
"firstTime": true

incident_snoozed

The incident was snoozed

annotation - an optional comment added to the snooze action

"annotation": "An Example Comment"

incident_splitted_destination

The incident was created from a subset of alerts as part of a split action

alert_ids - a list of the ID of each alert that was moved into this new incident
source_incident_id - the ID of the incident the alerts originally belonged to

"alert_ids": [ "60079deb82b0b2418470cacd"
],
"source_incident_id": "60079e56a95e4b1168f9c7b7",
("created_at": 1611112500846)

incident_splitted_source

One or more alerts within the incident were split into a new incident

alert_ids - a list of the ID of each alert that was moved into the new incident
new_incident_id - the ID of the new incident created with the selected alerts

"alert_ids": [
"60079deb82b0b2418470cacd"
],
"new_incident_id": "60079e56a95e4b1168f9c7b7"
("created_at": 1611112500846)

incident_unassigned

The user assigned responsibility to see the incident through resolution was removed

unassigned_on_reopen (true/false) - whether the incident was unassigned through the incident reopen process

"unassigned_on_reopen": false

incident_unsnoozed

The incident had the snooze status removed

None

incident_reopened

The incident reopened within BigPanda

None

incident_resolved_by_alerts

The incident was resolved automatically by BigPanda when all associated alerts received an 'ok' status

None