Field mappings between events and incidents

Use the following out-of-the-box catalog flows as templates for your personal flows to convert events into incidents and update events based on the updated incidents:

  • TSOM Events to create ITSM Incident
  • Incident Create/Update to informational Event Create/Update

The following sections provide information about the field mappings between BMC Helix ITSM and TrueSight Operations Management.

Related topics

Setting-up-Proactive-Service-Resolution-to-enable-automatic-incident-management

Use-case-Automatic-incident-management

Publishing-or-using-flows

Updating-or-deleting-flows

Field mappings for creating Helix ITSM incidents from TrueSight Operations Management events

Use the TSOM Event to create ITSM Incident catalog flow to design a personal flow that uses details from an event in TrueSight Operations Management to create an incident in BMC Helix ITSM. When a new event is propagated for incident creation, the following mappings from event to incident fields are required.

Important

Slot refers to the attribute name from the event. For example, in slot.msg, msg is an attribute in the event, and Infrastructure Event is a constant value.

 

WS API Request Field

Event Slot

Conditions / option values / comments 

Required incident field

(all mapping should exist)

Summary

slot.msg


Yes

Component_ID

slot.mc_smc_id


Yes

Product_Category_Tier1

slot.itsm_category 

$if( slot.itsm_category != "")

No

Product_Category_Tier2

slot.itsm_type

$if( slot.itsm_category != "")

No

Product_Category_Tier3

slot.itsm_item

$if(slot. itsm_category != "")

No

Categorization_Tier1

slot.itsm_operational_category1

$if(slot. itsm_operational_category1 != "")

No

Categorization_Tier2

slot.itsm_operational_category2

$if( slot.itsm_operational_category1 != "")

No

Categorization_Tier3

slot.itsm_operational_category3

$if( slot.itsm_operational_category1 != "")

No

Product_Name

<customer can map field>


No

Urgency

slot.mc_priority

PRIORITY_1      ->             1-Critical
 PRIORITY_2      ->             2-High    
 PRIORITY_3      ->             3-Medium  
 PRIORITY_4      ->             4-Low     
 PRIORITY_5      ->             4-Low  

Yes

impact 

slot.severity

 CRITICAL   ->           1-Extensive/Widespread
 MAJOR    ->              1-Extensive/Widespread
 MINoR        ->              2-Significant/Large  
 WARNING   ->              3-Moderate/Limited   
 INFO            ->              4-MiNor/Localized    
 OK              ->              4-MiNor/Localized    
 UNKNoWN    ->              4-MiNor/Localized   

Yes

Status_Event

slot.status 


Yes

Incident_Status

Resolved

If (event_status = closed)

No

Incident_Status_Reason

Automated Resolution Reported

If (event_status = closed)

No

use_case

BEM

$if($ClassName != "IBRSD_SM_INCIDENT")

Yes

Mc_ueid 

slot.mc_ueid


Yes

cellName

slot.cell_name


Yes

Company

slot.itsm_company 

default "Remedy, a BMC Software Company" if event itsm_company doesn't have a value

Yes

IncidentTemplateID

<tmplate_in_AR> 


No

Temp_Value1

# Temp_Value1 = <event slot that we require in custom Workflow>


No

Assignee

#Incident_assignee 

 <please map the slots that would have assignee info>

No

Assigned_Suport_Group

#Incident_Support_Group_Name

 <please map the slots that would have support group info>

No

Assigned_Suport_Company

#Incident_Support_Company 

 <please map the slots that would have support company info>

No

Assigned_Suport_Organization

#Incident_Support_Organization 

 <please map the slots that would have support organization info>

No

Work_Info_Details

$Format("Host=%s\nHost Class=%s\nHost Address=%s\Nobject=%s\Nobject Class=%s\nParameter=%s\nParameter Value=%s\nLocation=%s
\n Event with Severity: %s, Priority: %s, Status %s ",slot.mc_host,slot.mc_host_class,slot.mc_host_address,
slot.mc_object,slot.mc_object_class,slot.mc_parameter,slot.mc_parameter_value,slot.mc_location,slot.severity,
slot.mc_priority,slot.status);


Yes

Work_Info_Details

$Format("Description :%s\n", slot.app_description)

$if($ClassName="APM_INCIDENT_EV")
$if(slot.app_ID != "")

Yes

Notes

$Format("%s : BMC Impact Manager Initiated Incident",slot.msg)

if the length of the event message is more than 100 characters

Yes

Notes

BMC Impact Manager Initiated Incident

 if the length of the event message is less than 100 characters

Yes

Notes



Yes

Notes

$Format("itda_condition_operator : %s \n ita_condition_value : %s \n itda_search_data_endtime : %s \n
itda_search_data_starttime : %s \n itda_search_tags : %s \n itda_searchQuery : %s \n",
slot.itda_condition_operator,slot.itda_condition_value,slot.itda_search_data_endtime,
slot.itda_search_data_starttime,slot.itda_search_tags,slot.itda_searchQuery);

$if($ClassName = "ITDA_EVENT")

Yes

Notes

$Format("Application Type: %s\nApplication Web URL: %s",slot.app_type,slot.mc_tool_uri)

$if($ClassName="APM_INCIDENT_EV")
$if(slot.app_ID != "")

Yes

Action

PROCESS_EVENT


Yes

Reported_Source

BMC Impact Manager Event


Yes

Incident_Type

Infrastructure Event


Yes

Work_Info_Source

BMC Impact Manager Event


Yes

Work_Info_SecureLog

Yes


Yes

Work_Info_ViewAccess

Internal


Yes

Created_By

BiiARS


Yes

OutboundIdentifier

cell_name


Yes

Incident_Number

slot.itsm_incident_id


No

Work_Info_Type

BMC Impact Manager Update


Yes

CILookup

ci_lookup_key

If ( cmdclass  == “BMC_ComputerSystem”) then

BMC.CORE:BMC_ComputerSystem:HostName                    =             SourceField.host

BMC.CORE:BMC_ProtocolEndpoint:Address                        =             SourceField.hostAddress

If ( cmdclass  == “BMC_SoftwareServer”) then

BMC.CORE:BMC_ComputerSystem:HostName                    =             SourceField.host

BMC.CORE:BMC_ProtocolEndpoint:Address                        =             SourceField.hostAddress

BMC.CORE:BMC_SoftwareServer:InstanceName                =             SourceField.instanceName

BMC.CORE:BMC_SoftwareServer:Model                                =             SourceField.modelName

If ( cmdclass  == “BMC_SoftwareServer”) then

BMC.CORE:BMC_ComputerSystem:HostName                    =             SourceField.host

BMC.CORE:BMC_ProtocolEndpoint:Address                        =             SourceField.hostAddress

BMC.CORE:BMC_Database:InstanceName            =             SourceField.instanceName

BMC.CORE:BMC_Database:Model                                            =             SourceField.modelName

Default

                                Empty ( No out-of-the-box properties defined, but customer can add as a part of customization)

No

Incident Event API fields Mapping



Action

CREATE_EVENT


Yes


 # Added new for event object



EventData

slot.msg


Yes

eventDetectedAt

slot.mc_arrival_time

only when a new event occurs

No

EventArrivedAtServer

slot.date_reception

only when a new event occurs

No





EventSource

BPPM


Yes

EventMOM

BPPM


Yes

EventPriority

slot.mc_priority


Yes

EventSeverity

slot.severity


Yes

EventURL1

slot.mc_object_uri 


Yes





Mc_ueid

slot.mc_ueid


Yes

EventStatus

Open / Closed


Yes

eventClearedAt

slot.mc_date_modification

If (event_status = closed)

No

Incident_Status_Reason

Automated Resolution Reported

If (event_status = closed)

No

Incident_Status

Resolved

If (event_status = closed)

No

Field mappings for updating TrueSight Operations Management events based on BMC Helix ITSM incidents

Use the Incident Create/Update to informational Event Create/Update catalog flow to design a personal flow that creates or updates events in TrueSight Operations Management based on updates to BMC Helix ITSM incidents.

When an incident is created or updated, the corresponding informational event is created in TrueSight Operations Management. Refer to the following table for viewing the mappings from incident to event attributes.

Important

The constants are in quotes. For example, INFO.


Incident Creation API fields Mapping

Event Slot

Incident Field

Conditions / option values / comment 

CLASS

"CI_INCIDENT_INFO"

if(Component_id != null)

ClassName

"CI_INCIDENT_INFO"

if(Component_id != null)

prop_destination

Prop_destination

if(Component_id != null)

ci_incident_type

"IMPACTED"

if(Component_id != null && Msg.contains("Impacted Incident for Impacted CI"))

ci_incident_type

"CAUSAL"

if(Component_id != null && Msg.contains("Causal Incident for Causal CI"))

component_id

component_id

if(Component_id != null && usecase=="SIM")

manually_created_incident

manually_created_incident

if(Component_id != null && usecase=="SIM")

policy_name

policy_name

if(Component_id != null && usecase=="SIM")

bOrphanedRoot

bOrphanedRoot

if(Component_id != null && usecase=="SIM")

CLASS

"EVENT_INCIDENT_INFO"

if(Component_id == null)

ClassName

"EVENT_INCIDENT_INFO"

if(Component_id == null)

cell_name

cell_name


mc_relation_source

EventId


event_mc_ueid

EventId


msg

"Incident Information - "+Msg+" with Incident Id - "+ Incident_id


mc_ueid

"HD_Ticket_ "+Incident_id


itsm_incident_id

Incident_id


incident_id

Incident_id


incident_assignee

incident_assignee


incident_priority

incident_priority


incident_status

incident_status


incident_submitter

incident_submitter


itsm_company

itsm_company


itsm_incident_status

incident_status


mc_Notes

Incident_Notes


severity

"INFO"


incident_assignee_group

Assigned_group


Temp01

Temp01


Temp02

Temp02


Temp03

Temp03


Temp04

Temp04


Temp05

Temp05


Temp06

Temp06


Temp07

Temp07


Temp08

Temp08


Temp09

Temp09


Temp10

Temp10


status

"CLOSED"

if(Incident_status=="Closed")

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*