> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sre/ai-sre-for-administrators/set-up-runbook-management/workflows/use-system-fields-in-runbook-actions.md).

# Use System Fields in Runbook Actions

System fields provide access to incident and alert data in your runbook actions. These fields are automatically available based on your runbook context and can be referenced using Mustache templates or CEL expressions.

### Incident fields <a href="#incident-fields" id="incident-fields"></a>

These fields are automatically available when your runbook has incident context:

* `{{incident.id}}` - Unique incident identifier
* `{{incident.short_id}}` - Human-readable ID (e.g., "INC-123")
* `{{incident.title}}` - Incident title
* `{{incident.severity}}` - Severity level (SEV0, SEV1, SEV2, SEV3, SEV4)
* `{{incident.status}}` - Current status (detected, investigating, mitigating, resolved)
* `{{incident.created_at}}` - Creation timestamp
* `{{incident.updated_at}}` - Last update timestamp
* `{{incident.service}}` - Affected service name
* `{{incident.environment}}` - Environment (production, staging, development)
* `{{incident.owner}}` - Current owner/responder
* `{{incident.url}}` - Link to incident in AI SRE UI

***

### Activity fields (enhanced incident data) <a href="#activity-fields-enhanced-incident-data" id="activity-fields-enhanced-incident-data"></a>

The `Activity` namespace provides access to Harness-specific incident data, including full service objects with IDs:

* `{{Activity.id}}` - Activity identifier
* `{{Activity.title}}` - Activity title
* `{{Activity.severity}}` - Severity object
* `{{Activity.severity.id}}` - Severity ID (numeric)
* `{{Activity.status}}` - Current status
* `{{Activity.summary}}` - Activity summary
* `{{Activity.impacted_services}}` - Array of Harness service objects with `.id` and `.name` properties
* `{{Activity.url}}` - Link to activity in AI SRE UI

**Get Harness service IDs with CEL**:

```cel
// Extract all service IDs
Activity.impacted_services.map(s, s.id)

// Get first service ID
Activity.impacted_services[0].id

// Filter and extract API service IDs
Activity.impacted_services.filter(s, s.name.contains("api")).map(s, s.id)
```

{% hint style="info" %}
**WHY USE ACTIVITY INSTEAD OF INCIDENT?**

Use `Activity.impacted_services` when you need Harness service IDs (UUIDs) for API calls or pipeline triggers. The `incident.service` field only provides service names as strings.
{% endhint %}

***

### Alert fields <a href="#alert-fields" id="alert-fields"></a>

These fields are available when your runbook has alert context:

* `{{alert.id}}` - Unique alert identifier
* `{{alert.title}}` - Alert title
* `{{alert.priority}}` - Priority level (p1\_critical, p2\_error, p3\_warning, p4\_info)
* `{{alert.service}}` - Service associated with the alert
* `{{alert.source}}` - Alert source (Datadog, New Relic, Prometheus, etc.)
* `{{alert.timestamp}}` - When the alert was received
* `{{alert.fingerprint}}` - Deduplication fingerprint
* `{{alert.url}}` - Link to alert source (if available)

***

### Severity field usage <a href="#severity-field-usage" id="severity-field-usage"></a>

The severity field contains string values representing severity levels. When referencing severity in runbook actions:

| Severity Value                        | Display Label | Description                          |
| ------------------------------------- | ------------- | ------------------------------------ |
| `{{incident.severity}}` returns `"0"` | SEV0:Critical | System-wide outage                   |
| `{{incident.severity}}` returns `"1"` | SEV1:Major    | Significant service degradation      |
| `{{incident.severity}}` returns `"2"` | SEV2:Moderate | Partial service impact               |
| `{{incident.severity}}` returns `"3"` | SEV3:Minor    | Minor issue with workaround          |
| `{{incident.severity}}` returns `"4"` | SEV4:Cosmetic | Cosmetic issue, no functional impact |

**Example Slack message using severity**:

```mustache
🚨 **{{incident.severity}} Incident**
**Service**: {{incident.service}}
**Environment**: {{incident.environment}}
**Status**: {{incident.status}}

View incident: {{incident.url}}
```

Go to [Create runbook triggers](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/triggers/create-trigger.md#severity-field-values) to learn how to configure severity-based trigger conditions.

**CEL expression alternative**:

```cel
${{incident.severity == "0" ? "🚨 CRITICAL" : 
   incident.severity == "1" ? "⚠️ MAJOR" : 
   incident.severity == "2" ? "MODERATE" : 
   incident.severity == "3" ? "MINOR" : "COSMETIC"}}
```

***

### Custom fields <a href="#custom-fields" id="custom-fields"></a>

Custom fields defined on incident types or alert types are also available via Mustache syntax:

* `{{incident.custom_field_name}}` - Any custom field added to an incident type
* `{{alert.custom_field_name}}` - Any custom field added to an alert type

**Example**: If your "Service Incident" type has a custom field called `error_rate`, reference it as:

```mustache
{{incident.error_rate}}
```

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* Go to [Use Mustache templates in runbook actions](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/workflows/use-mustache-runbook-actions.md) to reference incident data with Mustache templates.
* Go to [Use CEL in runbook actions](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/workflows/use-cel-runbook-actions.md) to implement dynamic logic with CEL expressions.
* Go to [Best practices](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/workflows/best-practices.md) to review field usage guidelines.

{% hint style="info" %}
**Need Help?** Contact our support team by email at **<support@harness.io>** or visit the [Harness Documentation](https://docs.harness.io) for additional resources and troubleshooting guides.
{% endhint %}