Integrations
- Integrations
- 1Password
- Abnormal
- Absolute
- AbuseIPDB
- Adaptive Shield
- Adobe Cloud
- ADP
- Agari Phishing Response
- Airlock
- Airlock Digital
- Akamai Identity Cloud Social
- Alert Logic
- AlgoSec Firewall Analyzer
- AlienVault OTX
- AlienVault USM
- Anodot
- Ansible
- Anvilogic
- Any Run
- Apex One
- ArcSight ESM
- Area 1
- Asana
- Asset Panda
- Atlassian User Management
- Atlassian User Provisioning
- auth0
- Authentik
- Authomize
- Automox
- AWS
- AWS IAM Identity Center
- Axonius
- Azure
- Azure Data Explorer
- Azure DevOps
- Azure Log Analytics
- Azure Storage
- BambooHR
- Big Fix
- BigPanda
- Bitbucket
- Bitdefender
- Bitsight
- Bitwarden
- Black Duck
- Black Kite
- Blink
- BMC Remedy
- Box
- Brinqa
- Cato Networks
- Censys
- Check Point Harmony
- Check Point Infinity Events
- Check Point XDR-XPR
- Check Point Management
- Checkmarx One
- Checkmarx SAST
- Chorus
- Chronicle
- Cisco Advanced Phishing Protection
- Cisco Domain Protection
- Cisco Meraki
- Cisco Talos
- Cisco Umbrella
- Cisco Webex
- Claroty xDome
- ClearPass
- ClickHouse
- ClickUp
- Cloud Custodian
- Cloudflare
- Cobalt
- Compass
- Confluence
- Confluence Data Center
- Coralogix
- Coralogix Incident Management
- Cortex XDR
- Cortex Xpanse
- CredStash
- Cribl
- CrowdStrike
- CyberArk
- Cybersixgill
- CyCognito
- Cyera
- Cylance
- Cyware CTIX
- Darktrace
- Dasera
- Databricks
- Datadog
- DataSet
- Delighted
- Delinea
- Devo
- Discord
- Docusign
- Domo
- Drata
- Dropbox
- Dropbox Business
- Druva
- Duo
- Duo Auth
- Dynatrace
- EasyVista
- EchoTrail
- Egnyte
- Egnyte Secure Govern
- Elasticsearch
- Entro
- Ermetic
- Exabeam
- Exchange Online
- Expel
- F5 BIG IP
- Falcon LogScale
- Falcon Surface
- Flare.io
- Forcepoint DLP
- Forescout
- FortiGate
- Freshservice
- GCP
- Ghostwriter
- Git
- GitHub
- GitLab
- Glean
- Gmail
- Google Calendar
- Google Chat
- Google Docs
- Google Drive
- Google Forms
- Google Looker
- Google Meet
- Google Sheets
- Google Workspace
- Grafana
- Grip Security
- GYTPOL
- Have I Been Pwned
- HiBob
- HubSpot
- Hunters
- Hybrid Analysis
- Hyperproof
- IBM Cloud
- IBM NS1 Connect
- IBM X Force
- Imperva
- incident.io
- Infoblox Cloud Services Portal
- Integrations
- Intercom
- Intezer
- IP API
- IPinfo
- IPWHOIS
- Ironscales
- Ivanti RiskSense
- Jamf
- JetBrains
- JFrog
- Jira
- Jira Data Center
- Joe Sandbox
- JumpCloud
- Kandji
- Keeper Secrets Manager
- Kenna Security
- KnowBe4
- KnowBe4 Events
- Kubernetes
- Lacework
- LaunchDarkly
- Linear
- Litmos
- LogicMonitor
- LogRhythm
- Manage Engine ServiceDesk Plus
- Mattermost
- Maven
- Microsoft Defender For Cloud
- Microsoft Defender For Cloud Apps
- Microsoft Defender For Endpoints
- Microsoft Defender XDR
- Microsoft E-Discovery
- Microsoft Entra ID
- Microsoft Graph
- Microsoft Intune
- Microsoft Office 365 Management Activity
- Microsoft Outlook
- Microsoft Purview
- Microsoft Sentinel
- Microsoft SQL Server
- Microsoft Teams
- Mimecast
- MISP
- Monday
- MongoDB Atlas
- MxToolbox
- Neo4j
- NetBox
- Netography
- Netskope
- New Relic
- Nightfall AI
- NinjaOne
- Notion
- Nozomi Networks
- Nuclei
- Nucleus
- Nutanix Hypervisor
- Obsidian
- Okta
- OneDrive
- OneLogin
- OneTrust
- OpenAI
- OpenCTI
- Opsgenie
- OPSWAT
- Oracle Cloud
- Oracle HCM
- Orca Security
- OWASP ZAP
- PagerDuty
- Palo Alto Cloud NGFW
- Palo Alto Firewall
- Panther
- Pentera
- Perception Point
- PhishLabs
- PhishLabs Incident Data
- PhishLabs Open Web Monitoring
- Pingdom
- PingID
- PingOne
- PlexTrac
- PortSwigger
- Postman
- Postman SCIM
- Power BI
- PowerShell
- Prisma Access
- Prisma Cloud CSPM
- Prisma Cloud CWP
- Prometheus
- Proofpoint
- Proofpoint ITM
- Proofpoint Protection Server
- Proofpoint Security Awareness Training
- Proofpoint TAP
- Proofpoint Threat Response Auto Pull
- Pub-Sub
- QRadar
- Qualys
- Rapid7
- Rapid7 InsightIDR
- Rapid7 InsightVM Cloud
- Rapid7 Threat Command
- Reco
- Recorded Future
- Red Hat IdM
- Rippling
- runZero
- SafeBase
- Sage HR
- SailPoint
- SailPoint IdentityIQ
- Salesforce
- SAP Ariba
- ScienceLogic
- Securin
- Securin VI
- SecurityScorecard
- Securonix
- SemGrep
- SentinelOne
- ServiceNow
- SharePoint
- Shodan
- Shopify
- Silverfort
- Slack
- Smartsheet
- Snipe-IT
- Snowflake
- Snyk
- SolarWinds Service Desk
- SonarQube
- Sophos
- Split
- Splunk
- Splunk Observability
- Splunk SOAR
- Spur
- StrongDM
- Sumo Logic
- Symantec EDR
- Sysdig
- Tableau
- Tanium
- TeamCity
- TeamViewer
- Telegram
- Tenable
- Tenable Security Center
- Terraform
- Terraform Cloud
- TheHive
- Thinkst Canary
- ThreatQuotient
- Trellix Email Security
- Trello
- Trend Vision One
- Twilio
- UKG HR
- Uptycs
- URLScan
- Vault
- Veracode
- Verkada
- Vertica
- VirusTotal
- VMware Carbon Black
- VMware vSphere
- WeChat
- WhatsApp
- Whois
- WildFire
- Wiz
- Workday
- Workspace ONE UEM
- YesWeHack
- Zendesk
- Zero Networks
- Zoom
- Zscaler Internet Access
- Zscaler Private Access
Actions
Create Incident
Create a new incident.
Note that if the incident mode is set to “retrospective” then the new incident will not be announced in Slack.
To learn more, visit the incident.io documentation.
Basic Parameters
Parameter | Description |
---|---|
Idempotency Key | Unique string used to de-duplicate incident create requests. |
Name | Explanation of the incident. |
Summary | Detailed description of the incident. |
Visibility | Whether the incident should be open to anyone in your Slack workspace (public), or invite-only (private). For more information on Private Incidents see our help centre. |
Advanced Parameters
Parameter | Description |
---|---|
Custom Field Entries | Set the incident’s custom fields to these values. |
ID | Unique identifier for the incident. |
Incident Role Assignments | Assign incident roles to these people. |
Incident Status ID | Incident status to assign to the incident. |
Incident Timestamp Values | Assign the incident’s timestamps to these values. |
Incident Type ID | Incident type to create this incident as. |
Mode | Whether the incident is real, a test, a tutorial, or importing as a retrospective incident. |
Retrospective Incident Options Slack Channel ID | If the incident mode is ‘retrospective’, pass the ID of a Slack channel in your workspace to attach the incident to an existing channel, rather than creating a new one. |
Severity ID | Severity to create incident as. |
Slack Channel Name Override | Name of the Slack channel to create for this incident. |
Slack Team ID | Slack Team to create the incident in. |
Example Output
{ "incident": { "call_url": "https://zoom.us/foo", "created_at": "2021-08-17T13:28:57.801578Z", "creator": { "api_key": { "id": "01FCNDV6P870EA6S7TK1DSYDG0", "name": "My test API key" }, "user": { "email": "lisa@incident.io", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "name": "Lisa Karlin Curtis", "role": "viewer", "slack_user_id": "U02AYNF2XJM" } }, "custom_field_entries": [ { "custom_field": { "description": "Which team is impacted by this issue", "field_type": "single_select", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "name": "Affected Team", "options": [ { "custom_field_id": "01FCNDV6P870EA6S7TK1DSYDG0", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "sort_key": 10, "value": "Product" } ] }, "values": [ { "value_catalog_entry": { "aliases": [ "lawrence@incident.io", "lawrence" ], "external_id": "761722cd-d1d7-477b-ac7e-90f9e079dc33", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "name": "Primary On-call" }, "value_link": "https://google.com/", "value_numeric": "123.456", "value_option": { "custom_field_id": "01FCNDV6P870EA6S7TK1DSYDG0", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "sort_key": 10, "value": "Product" }, "value_text": "This is my text field, I hope you like it" } ] } ], "duration_metrics": [ { "duration_metric": { "id": "01FCNDV6P870EA6S7TK1DSYD5H", "name": "Lasted" }, "value_seconds": 1 } ], "external_issue_reference": { "issue_name": "INC-123", "issue_permalink": "https://linear.app/incident-io/issue/INC-1609/find-copywriter-to-write-up", "provider": "asana" }, "id": "01FDAG4SAP5TYPT98WGR2N7W91", "incident_role_assignments": [ { "assignee": { "email": "lisa@incident.io", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "name": "Lisa Karlin Curtis", "role": "viewer", "slack_user_id": "U02AYNF2XJM" }, "role": { "created_at": "2021-08-17T13:28:57.801578Z", "description": "The person currently coordinating the incident", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "instructions": "Take point on the incident; Make sure people are clear on responsibilities", "name": "Incident Lead", "required": false, "role_type": "lead", "shortform": "lead", "updated_at": "2021-08-17T13:28:57.801578Z" } } ], "incident_status": { "category": "triage", "created_at": "2021-08-17T13:28:57.801578Z", "description": "Impact has been **fully mitigated**, and we're ready to learn from this incident.", "id": "01FCNDV6P870EA6S7TK1DSYD5H", "name": "Closed", "rank": 4, "updated_at": "2021-08-17T13:28:57.801578Z" }, "incident_timestamp_values": [ { "incident_timestamp": { "id": "01FCNDV6P870EA6S7TK1DSYD5H", "name": "Impact started", "rank": 1 }, "value": { "value": "2021-08-17T13:28:57.801578Z" } } ], "incident_type": { "create_in_triage": "always", "created_at": "2021-08-17T13:28:57.801578Z", "description": "Customer facing production outages", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "is_default": false, "name": "Production Outage", "private_incidents_only": false, "updated_at": "2021-08-17T13:28:57.801578Z" }, "mode": "standard", "name": "Our database is sad", "permalink": "https://app.incident.io/incidents/123", "postmortem_document_url": "https://docs.google.com/my_doc_id", "reference": "INC-123", "severity": { "created_at": "2021-08-17T13:28:57.801578Z", "description": "Issues with **low impact**.", "id": "01FCNDV6P870EA6S7TK1DSYDG0", "name": "Minor", "rank": 1, "updated_at": "2021-08-17T13:28:57.801578Z" }, "slack_channel_id": "C02AW36C1M5", "slack_channel_name": "inc-165-green-parrot", "slack_team_id": "T02A1FSLE8J", "summary": "Our database is really really sad, and we don't know why yet.", "updated_at": "2021-08-17T13:28:57.801578Z", "visibility": "public", "workload_minutes_late": 40.7, "workload_minutes_sleeping": 0, "workload_minutes_total": 60.7, "workload_minutes_working": 20 }}
Workflow Library Example
Create Incident with Incidentio and Send Results Via Email
Preview this Workflow on desktop
Was this page helpful?