Filter Fields
Last updated - 24 July, 2025
The fields described in the following are available when building filters.
| Field | Description |
| _id | The ID of the database record. |
| # Alerts | Number of alerts, alert count. |
| # Events | Number of events, event count. |
| Actioned By | |
| Additional Comments (Customer Visible) | |
| Agent CI | Agent confiuration item. |
| Agent ID | ID of the agent. |
| Agent IP | IP address of the agent. |
| Agent Timestamp | |
| Alert Key | |
| Alert Key List | |
| Application | |
| Approval Group | |
| Asset | |
| Asset Tag | |
| Assigned To | The assignee of an alert or insight. |
| Assigment group | The assigned group for an alert or insight. |
| Attributes | |
| Caller | |
| Category | |
| Causal CI | The configuration item casuing an issue. |
| Checked in | |
| Checked out | |
| CI | Configuration item, for example a server or cloud instance. |
| Close notes | |
| Contact Type | |
| Comments | |
| Company | |
| Configuration Item | |
| Correlation ID | |
| Created Timestamp | |
| Department | |
| Description | |
| Display Name | |
| DNS Domain | |
| Details | |
| Earliest Event Timestamp | |
| Environment | |
| Escalation | The state of the workflow for an alert. |
| First Timestamp | |
| Fully qualified domain name | |
| Highest Severity | The highest severity level for an alert within a cluster. |
| Impact | |
| Impacted CIs | |
| Install Status | |
| Insight Key | |
| Insight Key List | |
| IP address | |
| Justification | |
| Last Timestamp | |
| Latest Event Timestamp | |
| Lease Contract | |
| Location | |
| Lowest Severity | The lowest severity level for an alert in a cluster. |
| MAC address | |
| Maintenance schedule | |
| Managed by | |
| Manufacturer | |
| ML Description | |
| ML Severity | |
| ML Source | |
| ML State | |
| ML Processor Timestamp | |
| ML UI Result | |
| Model category of component | |
| Model ID | |
| Model ID List | |
| Model number | |
| Monitor | |
| Most recent discovery | |
| Name | |
| Number | |
| Number of Rules Triggered | |
| Object | |
| Operational status | |
| Operating system | Operating system associated with a resource. |
| Organisation ID | |
| Original Key | |
| Owned by | |
| Parent | |
| Permanent URL | |
| Pipeline Timestamp | |
| Priority | |
| Region | |
| Requires verification | |
| Resolution Code | |
| RTO | |
| Rule Key | |
| Rule Name | The name of the rule applied. |
| Rule Value | |
| Rules Ids Triggered List | |
| Receiver ID | |
| Receiver Timestamp | |
| Serial number | |
| Incident ID | ID of an associated ticket in ServiceNow. |
| Incident Priority | Priority of an associated ticket in ServiceNow. |
| Incident URL | Link to an associated ticket in ServiceNow. |
| Incident Runbook URL | Link to an associated automation runbook in ServiceNow. |
| Severity | Severity level for an item. |
| Short description | |
| Source | |
| Source Record | |
| State | The state for an insight into the processing flow. |
| Status | |
| Sub Category | |
| Support Group | |
| Supported by | |
| Sys ID | |
| System Class Name | |
| Tags | Tags derived from the correlation model, summarizing associated item descriptions and relevant keywords. |
| Time | |
| Timestamp | |
| Updated Timestamp | |
| Urgency | |
| URL | |
| Vendor | |
| Version | |
| Warranty expiration | Enriching information added to ticket from ServiceNow. |
| Work Notes | Notes added to ticket in ServiceNow. |
