Field mappings for Proactive Service Resolution for incidents

Use this topic to learn about the field mappings available for mapping events to incidents and incidents to information events in the solution.

When you configure Proactive Service Resolution, by default, event fields are mapped to the incident fields. When an event that matches the trigger condition is generated in BHOM, an incident is automatically created in BMC Helix ITSM. The information in the event flows to the incident based on the fields mapped in the solution.

Important

The minimum required fields for creating an incident are already mapped with default values, and transformation is applied to some of the fields. You can choose to update the existing values or add new fields to be used while creating an incident. An incident gets created or updated based on these values. However, if you are using any custom fields in BMC Helix Operations Management or BMC Helix ITSM, ensure that you map them based on your environment.

We recommend that you do not delete any existing field mappings.

Event to incident field mapping

Consult the following table to learn about the required event-to-incident field mappings:

Incident field	Event field	Additional conditions
Impact	$.event.severity	-
Summary	$.event.msg	$.event.msg length less than 100
Urgency	$.event.priority	-
mc_ueid	$.event._identifier	-
Created_By	BiiARS	-
Action	PROCESS_EVENT	-
Incident Type	Infrastructure Event	-
Status_Event	$.event.status	-
CMDBLookupKey	ADDM_IntegrationID	-
Work_Info_SecureLog	Yes	-
Contact_Company	BMCOpsMonitoring	$.event.incident_company not empty
Reported_Source	BMC Impact Manager Event	-
z1D_IncidentFor	Causal Component Optimized	-
Work_Info_ViewAccess	Internal	-
Short Description	$.event.msg	$.event.msg length less than 254
OutboundIdentifier	$.event._identifier
Work_Info_Details	$.event.class	$.event.class == ALARM maps with Host=$.event.source_hostname Host Address=$.event.source_Address Object=$.event.object $.event.class == PATROL_EV maps with Host=$.event.source_hostname Host Address=$.event.source_Address Object=$.event.object Default mapping: Host=$.event.source_hostname Host Class=$.event.p_host_class Object=$.event.object
CILookupProperties	$.event.cdmclass==BMC_DataBase	The following properties are mapped with the respective event slots: BMC.CORE:BMC_ComputerSystem:HostName maps with $.event.source_hostname BMC.CORE:BMC_ProtocolEndpoint:Address maps with $.event.source_Address BMC.CORE:BMC_DataBase:InstanceName maps with $.event.instancename BMC.CORE:BMC_DataBase:Model maps with $.event.modelname BMC.CORE:BMC_ComputerSystem:Domain maps with $.event.source_hostname
Category	TSOM	-
use_case	PSR	-
Namespace	BMC.CORE	-
cell_name	-	-
Class Name	$.event.cdmclass	-
EventClearedAt	$.event.status	$.event.status==CLOSED maps with $.event._modified_time
Incident Number	$.event.incident_id	-
Incident_Status	$.event.status	$.event.status==CLOSED maps with Resolved
ComponentAliases	$.event.componentalias	$.event.status==CLOSED maps with empty
Work_Info_Type	BMC Impact Manager Update	-
ADDMIntegrationId	$.event._node_service_key_mapping	$.event.class==Situation maps with $.event.causal_node_keys :: $.event._service_key $.event.status==CLOSED maps with empty $.event.ia_rc_changed == true
Notes	BMC Helix Intelligent Automation Initiated Incident $.event.msg	$.event.msg length greater than 100 maps with $.event.msg $.event.class==Situation maps with \n Situation URL: https:// $.event.domain /aiops/#/situations/situation/
Incident_Status_Reason	$.event.status	$.event.status==CLOSED maps with Automated Resolution Reported

Incident to events field mapping

Consult the following table to learn about the incident-to-information event field mappings:

Event field	Incident field	Additional conditions
msg	Incident Information- $.event.msg with incident id $.event.IncidentNumber	-
object	Helix_IA_PSR	-
status	$.event.Incident_Status	$.event.Incident_Status == Closed maps with CLOSED $.event.Incident_Status == Resolved maps with CLOSED
severity	INFO	-
_identifier	HD_Incident_ $.event.IncidentNumber	-
incident_id	$.event.IncidentNumber	-
incident_status	$.event.Incident_Status	-
incident_company	$.event.Company	-
incident_priority	$.event.incident_priority	-
source_identifier	BMC-Helix-ITSM $.event.IncidentNumber	-
incident_relation_source	$.event.EventId	-
source_hostname	$.event.itsm_host	$.event.itsm_host is not empty
ci_incident_type	$.event.msg	$.event.msg contains Causal Incident for Causal CI maps with CAUSAL $.event.msg contains Impacted Incident for Impacted CI maps with IMPACTED UNKNOWN
incident_assignee	$.event.incident_assignee	-
incident_submitter	$.event.Submitter	-
incident_assignee_group	$.event.'Assigned Group'	-

Field mappings for Proactive Service Resolution for incidents

Event to incident field mapping

Incident to events field mapping

On this page