Activities Object

Defines the schema for activity types within incidents in BigPanda

General Parameters

The Activity object includes the following attributes. Many activity types include additional parameters included in the schema.

ParameterDescriptionType
idSystem-generated unique identifier for the activityString
typeThe type of activityString
timestampUnix epoch time when the activity occurred in the system (in seconds).Timestamp (in seconds)
created_byUser ID of the user who manually took actionString
paramsAdditional parameters according to the typeObject

Type-Specific Parameters

Each activity type has type-specific parameters included in the schema. These parameters will only be included for the relevant activity types.

Activity TypeDescriptionAdditional Parameters
incident_assignedA specific user was assigned responsibility to see the incident through resolutionassignee object:
id - the unique ID of the user the incident was assigned to
username - the username of the user the incident was assigned to
incident_become_flappingThe incident entered or exited the flapping state in which at least one correlated alert is changing states too frequentlyflapping (true/false)
- whether or not the incident is in the flapping state
incident_commentedA comment was added to the incidentcomment - the comment string added to the incident
incident_resolved_ui_manuallyThe incident was resolved by a user through the BigPanda UIannotation - an optional comment added to the resolver action
incident_resolved_apiThe incident was resolved by an API callannotation - an optional comment added to the resolver action
incident_alerts_resolvedOne or more of the alerts within the incident were manually resolvedannotation - an optional comment added to the resolver action
resolution_type - the method through which the alerts were resolved. One of: manual-ui, manual-api
ids_to_resolve - the unique id of the alerts that were resolved
incident_tag_removedAn incident tag was removed from the incidenttag_id - system-generated unique identifier for the incident tag
incident_tag_updatedAn incident tag was added to the incidenttag_id - system-generated unique identifier for the incident tag
tag_value - the content of the incident tag
incident_merged_destinationThe incident was the destination of a merge actionsource_incident_ids - A list of incidents that were merged into this destination incident
incident_merged_sourceThe incident was merged into a different incidenttargetIncidentId - The destination incident this incident was merged into
source_incident_ids - A list of incidents to merge into the destination incident defined in the URL path
incident_createdThe incident was created in the systemNone
incident_rcc_updateThe relationship between the incident and a potential root cause change match was updatedchange object:
identifier - he change's unique identifier from its original change system
ticket_url - the URL of the record in the change system
change_id - the unique identifier of the change in BigPanda
rcc_medata object:
change_id - the unique identifier of the change
updated_at - unix time of the last update to the change in BigPanda
match_certainty (MATCH, SUSPECT, or NONE) - the relationship status between the change and incident
match_type (manual-UI or Manual-API) - whether the relationship status between the change and incident was set by a user or the RCC algorithm
comment - an optional comment added to a manual match action
suggested_by_bigpanda (true/false) - whether the relationship status between the change and incident was suggested by BigPanda's RCC algorithm
incident_sharedThe incident was shared to an external channelshare_target - the channel or address the incident was sent to
share_auto (true/false) - whether the share was triggered by an AutoShare rule
escalation_id - an internal system id for the rule-match that triggers the share
annotation - an optional comment added to the share action
firstTime - whether or not this was the first time this incident was shared to the destination
incident_snoozedThe incident was snoozedannotation - an optional comment added to the snooze action
incident_splitted_destinationThe incident was created from a subset of alerts as part of a split actionalert_ids - a list of the ID of each alert that was moved into this new incident
source_incident_id - the ID of the incident the alerts originally belonged to
incident_splitted_sourceOne or more alerts within the incident were split into a new incidentalert_ids - a list of the ID of each alert that was moved into the new incident
new_incident_id - the ID of the new incident created with the selected alerts
incident_unassignedThe user assigned responsibility to see the incident through resolution was removedunassigned_on_reopen (true/false) - whether the incident was unassigned through the incident reopen process
incident_unsnoozedThe incident had the snooze status removedNone
incident_reopenedThe incident reopened within BigPandaNone
incident_resolved_by_alertsThe incident was resolved automatically by BigPanda when all associated alerts received an 'ok' statusNone

Sample Object:

{
    "items": [
        {
            "id": "161b4dc6c33740283e5416b0e6d6c70b",
            "timestamp": 1643700751,
            "type": "incident_shared",
            "created_by": "61950bc8c481fd1100abc3a3",
            "params": {
                "share_target": "webhook.whtest",
                "share_auto": false,
                "escalation_id": "61f8e20e89325b001201b9a3",
                "firstTime": true
            }
        },
        {
            "id": "5411150b64b2ad17da754b206e32f938",
            "timestamp": 1643700483,
            "type": "incident_shared",
            "created_by": "61950bc8c481fd1100abc3a3",
            "params": {
                "share_target": "webhook.amitwebook",
                "share_auto": false,
                "escalation_id": "61f8e102013bc30012204bff",
                "annotation": "this is another test",
                "firstTime": true
            }
        },
        {
            "id": "724df23d5ccc24d590ac4cddc306c892",
            "timestamp": 1641467377,
            "type": "incident_unsnoozed",
            "created_by": "57459f747dc1d7700e883ab2"
            }
        },
        {
            "id": "f9a27884d9193b3bba369b96b29434bd",
            "timestamp": 1641365710,
            "type": "incident_unassigned"
            }
        },
        {
            "id": "53bb1dbef847bcffbb838ba21c0972f9",
            "timestamp": 1641365708,
            "type": "incident_assigned",
            "created_by": "57459f747dc1d7700e883ab2",
            "params": {
                "assignee": {
                    "id": "5ea5be5bd97cad2836891e88",
                    "username": "[email protected]"
            }
        },
        {
            "id": "8df43e05a120198bdee009226f8bd86a",
            "timestamp": 1641365697,
            "type": "incident_snoozed",
            "created_by": "57459f747dc1d7700e883ab2",
            "params": {
                "time": 1633342764
            }
        },
        {
            "id": "f01fa98d40fd0beb4ef014a00d7aaf41",
            "timestamp": 1641365691,
            "type": "incident_shared",
            "created_by": "5519581afe04d9ba16bf9d07",
            "params": {
                "share_target": "slack.amitslack",
                "share_auto": true,
                "escalation_id": "61d540baf80bb900193e940c",
                "annotation": "This is a test",
                "firstTime": true
            }
        },
        {
            "id": "280f3b9ec3c5399e7ed053f0886f51ed",
            "timestamp": 1641365682,
            "type": "incident_created"
        }
    ],
    "page": 1,
    "total": 8
}