> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sre/ai-sre-for-administrators/set-up-incident-management/incident-fields.md).

# Configure Incident Fields

Learn how to configure and customize fields for incidents in Harness AI SRE.

### Overview <a href="#overview" id="overview"></a>

Incident fields help you:

* Capture essential incident data
* Standardize incident reporting
* Enable effective filtering
* Support automation
* Generate insights

***

### Field types <a href="#field-types" id="field-types"></a>

#### Required fields <a href="#required-fields" id="required-fields"></a>

**Basic information**

```yaml
field_definitions:
  title:
    type: string
    required: true
    template: "[service] - [issue_type]"
  severity:
    type: enum
    values: [P1, P2, P3, P4, P5]
    required: true
  status:
    type: enum
    values: [detected, investigating, mitigating, resolved]
    required: true
```

**Severity field values**

The severity field uses numeric string values internally. When configuring runbook triggers or API integrations, use these exact values:

| Value | Display Label | Severity Level    |
| ----- | ------------- | ----------------- |
| `"0"` | SEV0:Critical | Highest severity  |
| `"1"` | SEV1:Major    | High severity     |
| `"2"` | SEV2:Moderate | Moderate severity |
| `"3"` | SEV3:Minor    | Low severity      |
| `"4"` | SEV4:Cosmetic | Lowest severity   |

**Important:** Severity is stored as a string, not a number. When using severity in runbook triggers or API calls, always use the string format (for example, `"0"` not `0`).

**Customize severity labels:** You can customize the display labels for severity levels to match your organization's terminology. Go to [Customize severity and priority labels](/ai-sre/ai-sre-for-administrators/set-up-incident-management/severities-priorities.md) to configure custom labels while maintaining compatibility with integrations and APIs.

**Alternative severity names:** The system accepts alternative severity names from external integrations and maps them automatically:

* **Maps to "0":** `SEV0`, `SECURITY0`, `CUSTOMER-P0`
* **Maps to "1":** `SEV1`, `INTERNAL-PROD`, `SECURITY1`, `CUSTOMER-P1`
* **Maps to "2":** `SEV2`, `DEPLOYMENT`, `SECURITY2`
* **Maps to "3":** `SEV3`, `INTERNAL-NONPROD`, `MAINTENANCE`
* **Maps to "4":** Any other value

Go to [Configure runbook triggers](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/triggers/create-trigger.md#severity-field-values) to use severity values in trigger conditions.

**Service context**

```yaml
field_definitions:
  service:
    type: string
    required: true
    source: service_catalog
  environment:
    type: enum
    values: [production, staging, development]
    required: true
  team:
    type: string
    required: true
    source: team_directory
```

#### Optional fields <a href="#optional-fields" id="optional-fields"></a>

**Impact assessment**

```yaml
field_definitions:
  affected_users:
    type: number
    description: "Number of affected users"
  error_rate:
    type: float
    unit: "percentage"
  regions:
    type: array
    items:
      type: string
      source: region_list
```

**Timeline data**

```yaml
field_definitions:
  detected_at:
    type: timestamp
    format: "ISO8601"
  resolved_at:
    type: timestamp
    format: "ISO8601"
  duration:
    type: duration
    computed: true
    formula: "resolved_at - detected_at"
```

***

### Field configuration <a href="#field-configuration" id="field-configuration"></a>

#### Custom fields <a href="#custom-fields" id="custom-fields"></a>

```yaml
custom_fields:
  customer_impact:
    type: enum
    values: [none, low, medium, high, critical]
    description: "Impact level on customers"
  root_cause:
    type: string
    multiline: true
    description: "Root cause analysis"
  follow_up:
    type: array
    items:
      type: object
      properties:
        action: string
        owner: string
        due_date: timestamp
```

#### Field dependencies <a href="#field-dependencies" id="field-dependencies"></a>

```yaml
dependencies:
  - if:
      severity: P1
    then:
      required: [customer_impact, root_cause]
  - if:
      status: resolved
    then:
      required: [resolution_summary, follow_up]
```

#### Field validation <a href="#field-validation" id="field-validation"></a>

```yaml
validation:
  title:
    pattern: "[A-Za-z0-9\\s\\-]+"
    min_length: 10
    max_length: 100
  description:
    min_length: 50
    max_length: 1000
  affected_users:
    min: 0
    max: 1000000
```

***

### Field templates <a href="#field-templates" id="field-templates"></a>

#### Service incident <a href="#service-incident" id="service-incident"></a>

```yaml
template:
  name: "Service Incident"
  fields:
    title: "[service] - Service Degradation"
    severity: [severity]
    service: [service]
    environment: [environment]
    team: [team]
    description: "Service degradation detected in [service]"
```

#### Security incident <a href="#security-incident" id="security-incident"></a>

```yaml
template:
  name: "Security Incident"
  fields:
    title: "[service] - Security Alert"
    severity: P1
    service: [service]
    environment: [environment]
    team: "security"
    description: "Security incident detected in [service]"
```

#### Infrastructure incident <a href="#infrastructure-incident" id="infrastructure-incident"></a>

```yaml
template:
  name: "Infrastructure Incident"
  fields:
    title: "[service] - Infrastructure Issue"
    severity: [severity]
    service: [service]
    environment: [environment]
    team: "platform"
    description: "Infrastructure issue detected in [service]"
```

***

### Field usage <a href="#field-usage" id="field-usage"></a>

#### Incident creation <a href="#incident-creation" id="incident-creation"></a>

```yaml
create_incident:
  template: "Service Incident"
  values:
    service: [service]
    severity: P2
    environment: production
    team: [team]
```

#### Status updates <a href="#status-updates" id="status-updates"></a>

```yaml
update_status:
  status: investigating
  fields:
    assignee: [user]
    notes: "Investigation started by [user]"
```

#### Resolution <a href="#resolution" id="resolution"></a>

```yaml
resolve_incident:
  status: resolved
  fields:
    resolution_summary: [summary]
    root_cause: [root_cause]
    follow_up:
      - action: "Update runbook"
        owner: [team]
        due_date: [timestamp]
```

***

### Best practices <a href="#best-practices" id="best-practices"></a>

#### Field design <a href="#field-design" id="field-design"></a>

* Use clear names
* Add descriptions
* Set validations
* Group related fields
* Support automation

#### Templates <a href="#templates" id="templates"></a>

* Create for common cases
* Include required fields
* Set smart defaults
* Document usage
* Review periodically

#### Field management <a href="#field-management" id="field-management"></a>

* Audit field usage
* Clean unused fields
* Update validations
* Monitor effectiveness
* Gather feedback

***

### Next steps <a href="#next-steps" id="next-steps"></a>

#### Documentation <a href="#documentation" id="documentation"></a>

* [Incident overview](/ai-sre/ai-sre-for-administrators/set-up-incident-management/incidents.md): Understand the incident lifecycle.
* [Incident workflows](/ai-sre/ai-sre-for-administrators/set-up-incident-management/incident-workflows.md): Automate incident response.
* [Incident templates](/ai-sre/ai-sre-for-administrators/set-up-incident-management/incident-templates.md): Standardize incident creation.
* [Severity and priority labels](/ai-sre/ai-sre-for-administrators/set-up-incident-management/severities-priorities.md): Configure severity and priority.

#### Related topics <a href="#related-topics" id="related-topics"></a>

* [Configure fields](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/workflows/overview.md): Build workflow actions.
* [Route alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/alert-rules/overview.md): Route alerts to incidents.