Understand ITSI event data model fields

The ITSI event data model standardizes event data for alerts, changes, outages, and configuration item (CI) enrichment. Use this reference to identify the fields that apply to each event type.

How the model is organized

Every ITSI event uses the core event fields. An event in ITSI represents a monitoring alert from any source (Datadog, Dynatrace, AppDynamics, Nagios, etc.). Change events and outage events use the core fields and the specific fields for their event type. A change event represents a planned or executed change to infrastructure or systems. An outage event is about a window of expected unavailability.

You can add the enrichment fields to any event type when configuration item data is available. ITSI adds the enrichment fields to notable events.

Required fields must be present unless the field description states a conditional requirement. Optional fields provide additional context for correlation, grouping, de-duplication, and troubleshooting.

Note: The event_fingerprint, dedup_key, and correlation_key fields replace the previous alert_identifier_fields field for data integration templates that use the updated ITSI event data model.

Core event fields

Include the required core fields in every event. For a change event, set event_type to change. For an outage event, set event_type to outage.

Field Requirement Description Values or format
event_type Required Type of event represented by the payload. alert, change, outage, incident, internal, or task
signature Required Human-readable name of the event condition. Name of the rule of condition that triggered the alert, for example, JVM heap utilization above 90%
src Required Affected object, primary impacted object, or source of the event. hostname, service name, or other identifying name
src_name Optional Human-readable name of the primary affected or impacted object when the name differs from src or src_id. Additional descriptive name
src_id Optional Identifier for the primary affected CI, service, or entity. Identifier or URN
src_urn Optional Uniform resource name for the primary affected CI, service, or entity. URN
src_type Optional Type of the primary affected CI, service, or entity. For example, virtual_machine, firewall, network_switch, or storage
title Required Human-readable event title. Defaults to the value of signature
description Optional Human-readable event message or additional detail. Text
status Required Current event status. open, acknowledged, suppressed, autoRemediated, or closed
vendor_severity Required Original producer-specific severity of the event. For example, info, warning, minor, major, or critical
severity_id Optional Numeric severity indicator. Integer from 1 through 6
priority Optional Priority assigned to the event. P0 through P4
impacted_objects[] Optional Collection of additional objects affected by the event. Array of objects
impacted_objects[].id Conditionally required Identifier for an additional affected CI, service, or entity. Required for each object in impacted_objects[]. Examples include a hostname, service name, or other identifying name.
impacted_objects[].name Optional Human-readable name of an additional affected object. Additional descriptive name
impacted_objects[].urn Optional Uniform resource name of an additional affected object. URN
impacted_objects[].type Optional Type of an additional affected object. For example, virtual_machine, firewall, network_switch, or storage
producer_app Required Source system that produced the event. For example, Datadog, Dynatrace, or SCOM
producer_event_id Optional Original event or alert identifier from the source system. Text identifier, such as a GUID
producer_vendor Optional Name of the upstream provider. Can be inferred when producer_app identifies the provider
producer_rule Required Name of the detector, policy, check, or rule that produced the event. Text
producer_rule_id Optional Identifier of the detector, policy, check, or rule. Text identifier, such as a GUID or external identifier
event_fingerprint Required Stable natural key used for broad event categorization. For example, a combination of signature and src
dedup_key Optional Stable natural key used for event deduplication or throttling. For example, a combination of signature, src, and severity_id
correlation_key Optional Recommended value for grouping related events. For example, a CI system ID or service ID
links[] Optional Collection of links to related resources. Array of objects
links[].url Optional URL of a related resource. URI
links[].type Optional Purpose of the related URL. For example, runbook or drilldown
detected_at Required Time when the event was first detected. Timestamp
last_observed_at Optional Time of the latest event sample or update. Timestamp
closed_at Optional Time when the event status changed to closed. Timestamp

Change event fields

Include these fields with the core event fields for change events. Set event_type to change. The values of src and change_id identify the change record. Use impacted_objects[] for the CIs, services, or entities affected by the change.

Field Requirement Description Values or format
change_id Required Identifier of the change request or task. Expected to match src
change_type Optional Type of change. For example, deployment or patch
change_source Optional Source of the change record. For example, calendar, csv, or automation
change_status Optional Current status of the change. requested, open, completed, failed, or canceled
change_planned_start Optional Planned start time of the change. RFC 3339 timestamp
change_planned_end Optional Planned end time of the change. RFC 3339 timestamp
change_actual_start Optional Actual start time of the change. RFC 3339 timestamp
change_actual_end Optional Actual end time of the change. RFC 3339 timestamp
change_object_type Optional Type of object associated with the change. For example, virtual_machine, firewall, network_switch, or storage
change_risk Optional Risk or potential impact of the change. low, medium, or high
change_requestor Optional Person or system that requested the change. Email address, person, or system identifier
change_implementor Optional Person or system that implemented the change. Email address, person, or system identifier

Outage event fields

Include these fields with the core event fields for outage and maintenance window events. Set event_type to outage.

Table 1. Outage event fields
Field Requirement Description Values or format
outage_id Required Identifier of the outage event. Expected to match src and src_id
outage_type Optional Type of outage. For example, maintenance, planned, or unplanned
outage_start_datetime Required Start time of the outage. RFC 3339 timestamp
outage_end_datetime Required End time of the outage. RFC 3339 timestamp
outage_timezone Required Time zone for the outage window. Time-zone identifier
outage_maintenance_impact Optional Expected service impact during the outage or maintenance window. none, degraded, or downtime

CMDB CI enrichment fields

Add these fields to any event that is enriched with configuration item data from ServiceNow or another CMDB. The fields use the ci_ prefix.

Field Requirement Description Values or format
ci_id Required Stable identifier of the configuration item. Expected to match src or src_id
ci_name Required Human-readable name of the configuration item. Expected to match src or src_name
ci_aliases[] Optional Alternate identifiers or names for the configuration item. Array of strings, such as IP addresses or host names
ci_source Optional External source of the configuration item. For example, ServiceNow
ci_classification Optional Type of object represented by the configuration item. For example, server, application, or container
ci_location Optional Deployment or physical location of the configuration item. For example, building, rack, address, region, or geographic location
ci_environment Optional Deployment environment of the configuration item. For example, dev, staging, or prod
ci_support_group Optional Group responsible for supporting the configuration item. A group name or email address
ci_service_owner Optional Group or owner responsible for the service associated with the configuration item. A group name or email address
ci_relationships[] Optional Collection of known relationships between the configuration item and other configuration items. Array of objects
ci_relationships[].id Conditionally required Identifier of the related configuration item. Required for each object in ci_relationships[]
ci_relationships[].type Conditionally required Type of relationship to the related configuration item. Required for each object in ci_relationships[]; controlled value
ci_maintenance_status Optional Indicates whether the configuration item, entity, or service is in an active maintenance window. true or false
ci_operational_status Optional Operational status of the configuration item. "operatonal" or "non operational"
ci_last_updated_at Optional Time when the configuration item was last updated in the source. RFC 3339 timestamp

ITSI enrichment fields

ITSI uses these fields to add drilldowns, instructions, and schema metadata to notable events.

Field Requirement Description Values or format
itsi_drilldown_search_spl Optional SPL search for events related to the notable event. SPL
itsi_drilldown_search_label Optional Label for the related-event search. Text
itsi_drilldown_search_earliest Optional Earliest time modifier for the related-event search. For example, -60m
itsi_drilldown_search_latest Optional Latest time modifier for the related-event search. For example, now
itsi_drilldown_link_url Optional URL of a Splunk dashboard or external troubleshooting resource. URI
itsi_drilldown_link_label Optional Label for the drilldown link. Text
itsi_instruction Optional Instructions for responding to or investigating the episode. This is displayed on the ITSI Episode Interface Text
itsi_schema_version Required Version of the ITSI event data model used by the event. ITSI adds this internal field automatically