Incident Object

Defines the schema for an incident in BigPanda

🚧

Different Objects

The Incidents V2 API and Notifications Webhook return different fields and formatting. This object page lists the fields for calls made to the Incidents V2 API.

To configure a sharing integration or notifications webhook, see the Webhook Incident Object.

Parameters

The Incident object schema includes the following attributes:

ParameterDescriptionType
idSystem-generated unique identifier for the incident.String
statusCurrent incident status, which is determined by the most severe status of the correlated alerts.

Possible statuses: [critical, warning, unknown, ok].
String
activeWhether the incident contains at least one active alert and has not been manually resolved. An incident is automatically resolved when all the alerts are resolved.Boolean
severityThe highest status the incident reachedString
flappingWhether at least one correlated alert has changed states frequently enough to be treated as flappingBoolean
sharedWhether the incident has been sharedBoolean
snoozeSnooze options for the incident

Attributes:

snoozed - Whether the incident is currently snoozed.

end_time - Time when the current snooze period expires. Unix epoch time when X (in seconds).

cancel_on_incident_updates - Whether the current snooze should be automatically canceled if a new alert is added, the severity of an existing alert increases, or the incident is resolved and then reopens.
Object
maintenanceWhether an incident is in maintenance

null - not in maintenance
partial - one of the alerts is in maintenance
active - all alerts in maintenance
String
correlation_matchers_logLog of the correlation patterns matched to the incident over time.

As more alerts are added to the incident, the matched correlation patterns may change. When this happens, another array is added that contains the matching correlation patterns at that time.

Correlation Pattern Attributes:


correlation pattern id - system generated unique identifier for the correlation pattern.

time window - The time frame in which this pattern will correlate incoming alerts.

alert tags - Alert tags that match the correlation pattern rules.

The last item in the array is the most recent one.

If multiple correlation patterns match the incident, the pattern with the longest time window is the one that appears in the UI. See the Algorithmic Correlation documentation for more information.

When an incident is split, only the source incident maintains the correlation_matchers_log.
Array of Objects
startUnix epoch time when the earliest correlated alert was received (in seconds).Timestamp (in seconds)
changed_atUnix epoch time when the last incident change triggered applicable sharing updates (in seconds).Timestamp (in seconds)
updated_atUnix epoch time when the last change to the incident occurred (in seconds).Timestamp (in seconds)
endUnix epoch time when the incident was resolved, either manually or automatically when all alerts were resolved (in seconds).Timestamp (in seconds)
alertsArray of the alerts that the incident contains.

Attributes:

alert_id - System-generated unique identifier for the alert.

When the request comes with expand=alerts, it sends an array of alert object data.
Array
assigneeThe user assigned responsibility to see an incident through resolution

Attributes:

name - in system name of user

user_id - unique identifier of user

email - email associated with user
Object
assignerThe user who assigned responsibility for an incident

Attributes:

name - in system name of user

user_id - unique identifier of user

email - email associated with user
Object
environmentsEnvironment IDs for all environments the incident appears inArray
foldersFolder name of all folders the incident appears inArray
incident_tagsIncident tags associated with the incident

Attributes:

id - unique identifier for the tag

name - in system tag name

type - whether the tag is a Text, Priority or MultiValue tag

value - value of the incident tag according to its type
Array

Sample Object:

{
  "id": "60a4ee83bb7d9d046b8d7a93",
  "status": "Ok",
  "active": false,
  "severity": "Critical",
  "flapping": false,
  "shared": false,
  "maintenance": null,
  "start": 1621421699,
  "changed_at": 1629410549,
  "updated_at": 1629410549,
  "end": 1629410549,
  "alerts": [
    {
      "alert_id": "60a4ee83bb7d9d046b8d7a93"
    }
  ],
  "environments": [],
  "folders": [],
  "incident_tags": [],
  "correlation_matchers_log": [
    [
      {
        "time_window": 7200,
        "tags": [
          {
            "name": "case",
            "value": "sensitive1"
          }
        ],
        "correlation_id": "a02fde2f-0ec3-4cc2-9cbd-74895cb13050",
        "source_system": "api.backend_monitoring"
      }
    ]
  ]
}