Audit Log Resource Objects

Defines the schema for resources reported on by the audit log.

API Endpoint	https://api.bigpanda.io/resources/v2.0/audit/logs/
Supported Methods	GET

BigPanda audit logs report on Create, Update, and Delete actions for these resources:

Alert Correlation Patterns
AutoShare Settings
Environments
Users
Integrations
Maintenance Plans
Alert Enrichment including:
- Tags
- Tags Order
- Tag Enrichments
- Tag Enrichments Order
- Mapping Enrichment Schema
- Mapping Table Upload

Alert Correlation Pattern Parameters

The correlation_pattern object schema includes the following attributes:

Attribute	Description	Type
filter	A BPQL query to filter incoming alerts. Only matched alerts will be correlated based on the pattern.	String
cross_source	Determines if alerts can be correlated from different source systems into the same incident.Default is false.	Boolean
time_window	Time frame to determine correlation in minutes.	Integer
updated_at	The Unix Epoch time that the correlation pattern was last updated.	Timestamp (in seconds)
updated_by	The ID of the user who last updated the correlation pattern.	User ID
active	Whether the pattern should be applied to incoming alerts.	Boolean
created_at	The Unix Epoch time that the correlation pattern was created.	Timestamp (in seconds)
id	System-generated unique identifier for the correlation pattern.	String
created_by	The ID of the user who created the correlation pattern.	User ID
tags	Array of tag name(s) to correlate within the pattern.At least 1 item must appear in the array.No more than 5 items in the array.No duplicate names in the array.	Array

Sample Alert Correlation Pattern Object

{
  "resource_type": "correlation_pattern",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "filter": "cluster=_prod_",
    "cross_source": true,
    "time_window": 1-4320,
    "updated_at": 1372854204,
    "updated_by": "3123kjlhfasdlkjfh",
    "active": true,
    "created_at": "1493922189",
    "id": "631471d494528700126a5559",
    "created_by": "3123kjlhfasdlkjfh",
    "tags": ["service","check"]
  }

AutoShare Configuration Parameters

The auto_share_rules object schema includes the following attributes:

Attribute	Description	Type
id	System-generated unique identifier for the AutoShare rule.	String
env_id	The environment that the incident was shared from.	String
target_system_id	The name of the integration that incidents will be shared to.	String
name	UI name for the AutoShare rule, which includes environment and target integration names.	String
params	Settings for share and frequency. The attributes are:autoshare_options configuration settings, including share delay	Object

Sample AutoShare Configuration Object:

{
  "resource_type": "environment",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "target_system_id": "ai-analysis.automated_incident_analysis",
    "env_id": "f38469c6-356c-4ad9-85e9-88b69c627984",
    "name": "P0 All (ai-analysis.automated_incident_analysis)",
    "id": "f38469c6-356c-4ad9-85e9-88b69c627984_ai-analysis.automated_incident_analysis_0",
    "params": {
      "autoshare_options": {
      "share_delay_seconds": 120
      }
    }
  }
}

Environment Parameters

The environment object schema includes the following attributes:

Attribute	Description	Type
filter	A BPQL query to filter incoming incidents. Only matched incidents will be placed in the environment.	String
updated_at	The Unix Epoch time that the environment was last updated.	Timestamp (in seconds)
created_at	The Unix Epoch time that the environment was created.	Timestamp (in seconds)
name	The name of the environment as displayed in the BigPanda UI.	String
id	System-generated unique identifier for the environment.	String

Sample Environment Object:

{
  "resource_type": "environment",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "filter": "filter":"(source_system = /.*\\..*/ AND zero_impact != \"true\") OR (source_system = \"scout.default\" AND zero_impact != \"true\")",
    "updated_at": 1669032359,
    "created_at": "1669031477",
    "name": "inoc-team",
    "id": "637b6635c0ec7912005d58f8"
  }

User Parameters

The users object schema includes the following attributes:

Attribute	Description	Type
createdAt	The time the user was created. Unix epoch time (in seconds).	Timestamp
lastLoginAt	Unix epoch time when the user last logged in (in seconds).	Timestamp
name	The name of the user as displayed in the BigPanda UI.	String
id	Unique system identifier for the user.	String
state	State of the user in system.	String
firstLoginAt	The Unix Epoch time the user first logged in (in seconds).	Timestamp
username	The email address associated with the user.	String

Sample User Object:

{
  "resource_type": "users",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "createdAt": 1662284244,
    "lastLoginAt": 1662284281,
    "name": "Nataly",
    "state": "valid",
    "firstLoginAt": 1662284281,
    "username": "[email protected]",
    "id": "631471d494528700126a5559"
  }

Integrations Parameters

The integrations object schema includes the following attributes:

Attribute	Description	Type
target_system_id	Unique name for the integration.	String
stream_id	System-generated app_key for the integration.	String
updated_at	The Unix Epoch time that the environment was last updated.	Timestamp (in seconds)
org	The name of the BigPanda Organization where the update occurred.	String
changes	List of updated configuration properties with key, old_value and new_value.	Array of Objects

Sample Integrations Object:

{
  "target_system_id": "emailparser.1234",
  "stream_id": "2226ba0c9d377143dba39656d725fc9b",
  "updated_at": 1706896027,
  "org": "bigpanda",
  "changes": [{
    "key": "status",
    "old_value": {
      "status_map": {
        "critical": ["off"],
        "ok": ["better"]
      },
      "default_to": "critical",
      "source": "body"
    },
    "new_value": {
      "status_map": {
        "critical": ["off"],
        "ok": ["better"],
        "warning": ["warning"]
      },
      "default_to": "critical",
      "source": "body"
    }
  }, {
    "key": "allow_list",
    "old_value": ["*@bigpanda.io"],
    "new_value": [[email protected]"]
  }]
}

Maintenance Plan and Alert Filtering Parameters

The alert_filtering object schema includes the following attributes:

Attribute	Description	Type
plan_name	Name of the maintenance plan or alert filter associated with the action.	String
plan_id	The ID number of the maintenance plan or alert filter.	String
plan_status	The current status of the maintenance plan or alert filter.	String
plan_type	The type of plan - either `maintenance_plan` or `filtering_plan`, depending on if you created a Maintenance Plan or an Alert Filter.	String
time_window	Details of the maintenance plan's time window and whether or not it's recurring. Contains the attributes: `start` - Unix epoch time when the scheduled plan starts (in seconds). `end` - Unix epoch time when the scheduled plan ends (in seconds). `frequency` - How often a recurring plan is scheduled to run. `frequency_data` - Array of objects that defines the plan window for recurring plans. - `duration` - Length of time the plan should run (in seconds). - `current_run` - Unix epoch time when the current running maintenance window began (in seconds). - `next_run` - Unix epoch time when the next scheduled maintenance window starts (in seconds). - `relativity` - What week in the month the window should take place.	Array of Objects
updated_fields	The field that was updated in the maintenance plan. `field_name` - The name of the updated field. `old_value` - The old field value that was changed. `current_value` - The updated field value.	Array of Objects

Sample Maintenance Plan/Alert Filtering Object

  {
        "object": {
            "plan_name": "Monthly Cleanup",
            "plan_id": "641de370310000dc501081b2",
            "plan_status": "planned",
            "plan_type": "maintenance_plan",
            "time_window": {
                "start": 1679680834,
                "end": 32788738800,
                "frequency": "Monthly",
                "frequency_data": {
                    "duration": 12600,
                    "current_run": null,
                    "next_run": 1690574400,
                    "relativity": null
                }
            },
            "updated_fields": [
                {
                    "field_name": "end",
                    "old_value": "32605567199",
                    "new_value": "32788738800"
                }
            ]
        },
        "resource_id": "641de370310000dc501081b2",
        "resource_type": "alert_filtering",
        "timestamp": 1716471783
    }

Alert Enrichment Parameters

Alert Enrichment audit logs report on several sub-objects including:

Tag
Tags Order
Tag Enrichments
Tag Enrichments Order
Mapping Enrichment
Mapping Table Upload

Tag Object

The tag object schema includes the following attributes:

Attribute	Description	Type
name	Tag name in BigPanda.	String
created_by	The unique ID associated with the user who created the tag.	String
created_at	The Unix epoch time when the tag was created (in seconds).	Timestamp
updated_by	The unique ID associated with the user who last updated the tag.	String
updated_at	The Unix epoch time when the tag was last updated (in seconds).	Timestamp
description	A brief summary of the tag	String
active	Whether the tag should be applied to incoming alerts.	Boolean
enrichments	List of automatic enrichment items configured for this tag. Items are listed in their run order.	Array of Objects

Sample Alert Tag Object:

{
 "resource_type": "tag",
 "resource_id": "631471d494528700126ca555",
 "timestamp": 1662284339,
 "object": {
   "name": “region”,
   "created_by": "60c5238222fa55553d93d555",
   "created_at": 1635260171,
   "updated_by": "60c5238222fa55553d93d555",
   "updated_at": 1662284281,
   "description": "line of business",
   "active": true,
   "enrichments": [
     { "type": "extraction",
       "active": true,
       "when": {},
       "config": {
         "source": "host",
         "destination": "tag_name",
         "regex": "(.*)",
         "template": null
         },
       "note": null
      },
      {
        "type": "composition",
        "active": true,
        "when": {},
        "config": {
          "destination": "tag_name",
          "value": "val-${host6666}"
          },
        "note": "wiki.com"
      }
    ]
 }

Tags Order Object

The tag_order object schema includes the following attributes:

Attribute	Description	Type
created_by	The user who created the tag order.	String
alert_tags_order	Alert tags listed in the order they should be run. By default, tags are ordered by creation time.	Array of Strings

Sample Tag Order Object:

{
  "resource_type": "tag_order",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "created_by": "60c5238222fa55553d93d555",
    "alert_tags_order": ["owner", "cluster", "host"]
  }

Alert Enrichment Object

The tag_enrichments object schema includes the following attributes:

Attribute	Description	Type
id	System-generated unique identifier for the automatic enrichment item.	String
type	Automatic Enrichment rule type.One of: composition, extraction	String
active	Whether the rule should be applied to incoming alerts.	Boolean
when	A BPQL query to filter incoming alerts. Only matched alerts will receive a value based on the enrichment item.	Object
version	Internal version number of the current enrichment item.This number is incremented automatically each time the item is updated.	Integer
config	Rules for building or extracting tag values from event data.Configuration attributes are unique to the enrichment type. See the Config Attributes tables for more information.	Object
created_by	The unique ID associated with the user who created the enrichment item.	String
updated_by	The unique ID associated with the user who last updated the enrichment item.	String
note	A description of the enrichment item purpose or functionality.	String

Sample Alert Enrichment Object:

{
  "resource_type": "tag_enrichments",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "id": "191217f6-481d-464e-9f12-3ed846a72555",
    "type": "composition",
    "active": true,
    "when": {
      "IN": ["source_system", ["type": "regex", "value": "*"}]]
      },
    "version": 1,
    "config": {
      “source”: “nagios”,
      "destination": "tag_name",
      "value": "val-${host6666}"
      },
    "created_by": "60c5238222fa55553d93d555",
    "updated_by": "60c5238222fa55553d93d555",
    "note": "special extraction for nagios"
  }

Tag Enrichments Order Object

The tag_enrichments_order object schema includes the following attributes:

Attribute	Description	Type
created_by	The user who created the enrichment item order.	String
enrichment_order	Enrichment items listed in the order they should be run. By default, items are ordered by creation time.	Array of Strings

Sample Tag Enrichment Order Object

{
  "resource_type": "tag_enrichments_order",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "created_by": "60c5238222fa55553d93d555",
    "enrichment_order": [
         "49ff0d51-8e73-43a7-9cdd-6ffff242666",
         "5036032b-eb0c-461e-ff17-74a05785777",
         "d987df48-83f6-40ff-a985-ad6f8927888",
         "6cff549b-7c14-43f9-950f-3f73706ff99"
       ]
  }

Mapping Enrichment Object

The mapping_enrichment object schema includes the following attributes:

Attribute	Description	Type
id	System-generated unique identifier for the enrichment map schema.	String
type	Enrichment function type used to create enrichment items.Must be “mapping” for mapping enrichment endpoints.	String
active	Whether the mapping rules should be applied to incoming alerts.	Boolean
when	BPQL query to filter incoming alerts. Only matched alerts will receive a value based on the automatic enrichment item.

Sample Mapping Enrichment Object

{
  "resource_type": "mapping_enrichment",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "id": "1234a53b6789c12d3efg45h",
    "type": "mapping",
    "active": true,
    "when": { "IN": [ "source_system", [ { "type": "regex", "value": "*" } ] ] },
    "version": 1,
    "config": {
      "name": "example",
     "fields": [ {
         "title": "application",
         "type": "query_tag",
         "tag_name": "yes",
         "override_existing": true,
         "optional": false
         },
         {
         "title": "walla",
         "type": "result_tag",
         "tag_name": "walla", "override_existing": false
         }
      ],
      "id_generation_function": "use_md5",
      "case_insensitive": false
     },
    "created_by": "631471d494528700126a5559",
    "updated_by": "631471d494528700126a5559",
    "note": "Current runbook table"
  }

Mapping Table Upload Object

The mapping_table_upload object schema includes the following attributes:

Attribute	Description	Type
total_count	Total number of results. Returned with a GET call only.	Integer
items	The mapping data, in a JSON body	Array of strings

Sample Mapping Table Upload Object

{
  "resource_type": "mapping_table_upload",
  "resource_id": "631471d494528700126ca555",
  "timestamp": 1662284339,
  "object": {
    "total_count": 473,
    "items": [
       {
       "application": "sale24s",
       "yes_sir": "first_tag_dynamic_value_2",
       "no_sir": "second_tag_dynamic_value_2"
       },
       {
       "application": "billing23",
       "yes_sir": "first_tag_dynamic_value",
       "no_sir": "second_tag_dynamic_value"
       }
     ]
  }