| Name | Type | Description | Notes |
|---|---|---|---|
| shard_id | int | [optional] | |
| account | str | Account holds the tenant name so that slicing and dicing on the master can leverage bleve | [optional] |
| activated | datetime | When was this activated | [optional] |
| activatinging_user_id | str | The user that activated this investigation | [optional] |
| autime | int | AlmostUniqueTime is an attempt to have a unique sortable ID for an incident | [optional] |
| canvases | list[str] | Canvases of the incident | [optional] |
| category | str | Category | [optional] |
| close_notes | str | Notes for closing the incident | [optional] |
| close_reason | str | The reason for closing the incident (select from existing predefined values) | [optional] |
| closed | datetime | When was this closed | [optional] |
| closing_user_id | str | The user ID that closed this investigation | [optional] |
| create_investigation | bool | [optional] | |
| created | datetime | When was this created | [optional] |
| details | str | The details of the incident - reason, etc. | [optional] |
| dropped_count | int | DroppedCount ... | [optional] |
| due_date | datetime | SLA | [optional] |
| has_role | bool | Internal field to make queries on role faster | [optional] |
| id | str | [optional] | |
| investigation_id | str | Investigation that was opened as a result of the incoming event | [optional] |
| is_playground | bool | IsPlayGround | [optional] |
| labels | list[Label] | Labels related to incident - each label is composed of a type and value | [optional] |
| last_open | datetime | [optional] | |
| linked_count | int | LinkedCount ... | [optional] |
| linked_incidents | list[str] | LinkedIncidents incidents that were marked as linked by user | [optional] |
| modified | datetime | [optional] | |
| name | str | Incident Name - given by user | [optional] |
| notify_time | datetime | Incdicates when last this field was changed with a value that supposed to send a notification | [optional] |
| occurred | datetime | When this incident has really occurred | [optional] |
| open_duration | int | Duration incident was open | [optional] |
| owner | str | The user who owns this incident | [optional] |
| parent | str | Parent | [optional] |
| phase | str | Phase | [optional] |
| playbook_id | str | The associated playbook for this incident | [optional] |
| previous_roles | list[str] | PreviousRoleName - do not change this field manually | [optional] |
| raw_category | str | [optional] | |
| raw_close_reason | str | The reason for closing the incident (select from existing predefined values) | [optional] |
| raw_json | str | [optional] | |
| raw_name | str | Incident RawName | [optional] |
| raw_phase | str | RawPhase | [optional] |
| raw_type | str | Incident raw type | [optional] |
| reason | str | The reason for the resolve | [optional] |
| reminder | datetime | When if at all to send a reminder | [optional] |
| roles | list[str] | The role assigned to this investigation | [optional] |
| run_status | RunStatus | [optional] | |
| severity | Severity | [optional] | |
| sla | SLAState | [optional] | |
| sort_values | list[str] | [optional] | |
| source_brand | str | SourceBrand ... | [optional] |
| source_instance | str | SourceInstance ... | [optional] |
| status | IncidentStatus | [optional] | |
| type | str | Incident type | [optional] |
| version | int | [optional] | |
| custom_fields | CustomFields | [optional] |