Parameters

The OIM Alert object schema includes the following attributes:

Sample Alert Payloads

{ "app_key": "<app_key>",
    "status": "critical",
    "host": "production-database-1",
    "check": "CPU overloaded",
    "timestamp": 1402303570,
    "application": "Billing",
    "regions":["US1","US2","EMEA"],
    "count": 47
    "description": "CPU is above warning limit (40%)",}

{ "app_key": "<APP KEY>",
          "alerts": [{
               "status": "critical",
               "host": "production-database-1",
               "check": "CPU overloaded",
               "description": "CPU is above warning limit (40%)"
           }, {
               "status": "critical",
               "host": "production-database-2",
               "check": "CPU overloaded",
               "timestamp": 1402303570,
               "application": "Billing"
           }]
       }

Authentication

The Open Integration Manager offers additional flexibility with authentication parameters. The following syntax can be used for the Token and App Key:

Auth Token:
query string: access_token=<token>
header: Authorization: Bearer <token>
header: x-auth-token: <token>

App Key:
query string: app_key=<app_key>
header: x-app-key: <app_key>
header: app_key: <app_key>
body: { "app_key": "<app_key>" }

This means that an alert can be sent to BigPanda even if the monitoring tool is not able to include any information in the API call's header, like in the example below:

https://integrations.bigpanda.io/oim/api/alerts?access_token=xxx&app_key=xxx

Event Properties

The attributes included in the JSON payload become tags in BigPanda.

You can add any number of custom JSON attributes with a string, integer, or array value to the payload. Common fields include host, host, service, application, device, check, sensor, cluster, node, data center, region, and description.

When configuring the data to send through the OIM Alerts API, send attributes that:

• Drive deduplication, correlation, and UI titling. Event attributes enable BigPanda to turn noisy events into high-quality alerts and actionable incidents.
• Add context about the event, including where or when the alert triggered. Additional information helps your team understand the full situation while investigating an issue.
• Enable automation and categorization. Tags such as business element or team help you build environments, AutoShare rules, analytics, and workflows.
• Set next steps for triage and remediation. Including links to runbook wikis or investigation tools helps your team take action quicker. If a tag value starts with http, BigPanda automatically adds a link button.

Primary and Secondary Properties

Two tags are identified as the Primary and Secondary properties within BigPanda. Primary and Secondary properties are key data fields that function as the main name for alerts and drive correlation, event normalization, and deduplication. Ensure that the fields that map to the BigPanda tags marked as primary or secondary are included in all payloads.

❗

️

BigPanda cannot receive events without a primary_property.

Sending Multiple Alerts

If you want to send more than one alert in a single API call, you can modify the JSON payload to send an array of alert objects. When sending multiple alerts at the same time, you can choose to specify the app_key one time instead of for each alert.

❗

️Sending multiple alerts with the OIM REST API

BigPanda uses the timestamp to determine the latest status of an alert. If it is not included, BigPanda uses the time when the event is received. To ensure that BigPanda accurately reflects the current status, when sending multiple events, you must include the timestamp for each event or sort the alerts array by when the events occurred, in ascending order.

To send multiple alerts, you must also select the Create multiple alerts using checkbox within OIM and specify the name of the alerts array (which may be alerts or something else), and save your integration configuration.