> ## Documentation Index > Fetch the complete documentation index at: https://docs.germainux.com/llms.txt > Use this file to discover all available pages before exploring further. # Deploy Incident Intelligence for BigPanda > Send GermainUX SLA breaches to BigPanda as deduplicated alerts through a GermainUX HTTP Action and the BigPanda Alerts API. Components [`Engine`](https://docs.germainux.com/main/germain-ux-engine) Availability 2017.1 or later > **[Create the BigPanda Integration](#step-1-create-the-alerts-rest-api-integration-in-bigpanda)** > > App Key, API key and endpoint > **[Create the GermainUX HTTP Action](#step-2-create-the-http-action-in-germainux)** > > Sending alerts over HTTP > **[Payload Fields and Severity](#payload-fields-and-severity-mapping)** > > Deduplication and status mapping > **[Troubleshooting](#troubleshooting)** > > Common errors and fixes ## Overview GermainUX sends alerts to BigPanda through a GermainUX **HTTP Action** that POSTs each SLA breach to the BigPanda Alerts API. BigPanda then deduplicates, correlates and prioritizes those alerts alongside your other monitoring sources. What you get: * GermainUX SLA breaches (failed transactions, slow responses, application errors, failed synthetic scenarios) appear as BigPanda alerts. * Each alert carries GermainUX context: KPI, SLA, severity, host and error details. * Repeat breaches of the same KPI and SLA collapse into one BigPanda alert instead of a stream of duplicates. ## Architecture ![Image](https://mintcdn.com/germain-ux/5gmUTuZk25NXh-d-/images/image-9.png?fit=max\&auto=format\&n=5gmUTuZk25NXh-d-\&q=85\&s=d6a386b8b2ea69459c59277999214452) When an SLA is breached, GermainUX runs the HTTP Action assigned to it. The action renders a JSON body from the alert context and POSTs it to the BigPanda Alerts API (`HTTPS POST /data/v2/alerts`), where it is deduplicated on KPI + SLA name and correlated into incidents. | Stage | What happens | | - | - | | **GermainUX** | An SLA is breached on a KPI | | **HTTP Action** | Runs as the SLA Action and renders the JSON body | | **BigPanda Alerts** | Deduplicates on KPI + SLA name | | **BigPanda incident** | Correlated, then triaged by operations | A repeat breach of the same KPI + SLA updates the existing BigPanda alert; an event with status `ok` resolves it. ## Step 1: Create the Alerts REST API integration in BigPanda **1. Create the integration** In BigPanda, open **Integrations**, create a new integration and choose the **Alerts REST API** integration type. **2. Name the integration** Name it so the source is clear, for example `GermainUX` or `GermainUX - Production`. **3. Generate the App Key** Generate the integration's **App Key** and copy it. Every alert GermainUX sends includes this value as `app_key`. **4. Get a User API Key** Create or copy a **User API Key** for the account that will send alerts. A dedicated service account is recommended. **5. Note your region's endpoint** For US-hosted organizations: ```text theme={null} POST https://api.bigpanda.io/data/v2/alerts Authorization: Bearer Accept: application/json Content-Type: application/json ``` For EU-hosted organizations, use `https://api.eu.bigpanda.io/data/v2/alerts`. A successful request returns `201`. ## Step 2: Create the HTTP Action in GermainUX Go to: **GermainUX Workspace > Automation > HTTP** Select the **Add** icon to open the HTTP Action wizard. The same wizard is available under **Settings > Wizards > HTTP Action**. ### Configure the Action | Field | Value | | - | - | | **Name** | `Send Alert to BigPanda` | Select **Next**. ### Configure the HTTP Request | Field | Value | | - | - | | **Path** | `https://api.bigpanda.io/data/v2/alerts` (or the EU endpoint) | | **Request Method** | `POST` | | **Content Type** | `application/json` | | **Headers** | `Accept: application/json` and `Authorization: Bearer ` | | **Authentication** | Store the BigPanda API key as a protected GermainUX credential reference instead of typing it into the header or body | | **Expected Response** | `201` (any `2xx` is a success) | | **Request body** | The template below | #### Request Body Template The body is a FreeMarker template rendered against the SLA alert context: ```json theme={null} { "app_key": "", "status": "<#if context.sla??><#if context.sla.severity.ordinal() <= 1>critical<#else>warning<#else>warning", "host": "<#if context.fact?? && context.fact.system?? && context.fact.system.hostname??>${context.fact.system.hostname?json_string}<#else>${context.kpi.name?json_string}", "kpi": "${context.kpi.name?json_string}", "check": "<#if context.sla??>${context.sla.name?json_string}<#else>GermainUX alert", "description": "GermainUX detected that SLA <#if context.sla??>${context.sla.name?json_string} was not met. Error details: <#if context.fact?? && context.fact.details??>${context.fact.details?json_string}<#else>none", "source": "AggregateSLA", "environment": "prod", "origin": "GermainUX", "primary_property": "kpi", "secondary_property": "check" } ``` Replace `` with the App Key from Step 1, and set `source` and `environment` to match the KPI. Use `?json_string` on every value taken from the context, so quotes and line breaks in error details don't break the JSON. ## Step 3: Assign the HTTP Action to an SLA **1. Open the KPI you want to send to BigPanda** For example, a synthetic scenario KPI or an application error KPI. **2. Select or configure an SLA** Select an existing SLA on that KPI, or [configure a new one](https://docs.germainux.com/main/configure-sla.md) with the breach condition you want to alert on. **3. Add the HTTP Action as the SLA Action** Add the `Send Alert to BigPanda` HTTP Action as the SLA's **SLA Action**. **4. Repeat for every KPI and SLA that should reach BigPanda** One HTTP Action can be shared by many SLAs. HTTP Actions can also run on a schedule, from a rule, or manually. For BigPanda, the SLA trigger is recommended because it supplies the `context.sla` and `context.kpi` values the template uses. ## Step 4: Finish and Test **1. Confirm the Action Service can reach BigPanda** Before saving the action, send a test alert from the GermainUX server running the Action Service: ```bash theme={null} curl -i -X POST 'https://api.bigpanda.io/data/v2/alerts' \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{"app_key":"","status":"critical","host":"germain-test","check":"GermainUX integration test","description":"Test alert from GermainUX"}' ``` **2. Complete the wizard, then run the HTTP Action manually from the Workspace and confirm it reports success** **3. In BigPanda, confirm the alert appears on the integration and opens an incident** **4. Force a controlled SLA breach on a test KPI and confirm the alert arrives with the right KPI, SLA, host, status and description** **5. Trigger the same breach again and confirm BigPanda updates the existing alert instead of creating a new one** **6. Confirm the API key does not appear in GermainUX logs or notifications** **7. Assign the action to production SLAs** ## Payload Fields and Severity Mapping BigPanda deduplicates alerts on the fields named in `primary_property` and `secondary_property`. The template uses the KPI name and SLA name, so repeat breaches of the same SLA update one BigPanda alert. | BigPanda field | GermainUX source | Notes | | - | - | - | | `app_key` | BigPanda App Key | Required. From Step 1 | | `status` | `context.sla.severity.ordinal()` | Required. See severity mapping below | | `host` | `context.fact.system.hostname`, falling back to `context.kpi.name` | Aggregate SLAs may have no single host | | `kpi` | `context.kpi.name` | Primary dedup key | | `check` | `context.sla.name` | Secondary dedup key. Keep SLA names stable: renaming creates new BigPanda alerts | | `description` | `context.sla.name` + `context.fact.details` | Shown as the alert summary in BigPanda | | `source`, `environment`, `origin` | Set per HTTP Action | Any extra field becomes a BigPanda tag for enrichment and correlation | | `primary_property` / `secondary_property` | Fixed: `"kpi"`, `"check"` | Field names, not values | ### Severity Mapping BigPanda accepts four `status` values. The template sets `status` from `context.sla.severity.ordinal()`, where `0` is the most severe SLA level. Test the mapping before production. | BigPanda `status` | Meaning in BigPanda | Sent by GermainUX when | | - | - | - | | `critical` | Active alert, highest severity | SLA severity ordinal is 0 or 1 | | `warning` | Active alert, lower severity | SLA severity ordinal is 2 or higher, or no SLA is in context | | `ok` | Alert resolved | A recovery event is sent (see [Resolving Alerts in BigPanda](#resolving-alerts-in-bigpanda)) | | `acknowledged` | Alert acknowledged | Not sent by this integration; set in BigPanda | ## Resolving Alerts in BigPanda The HTTP Action sends an event when an SLA is breached. A BigPanda alert resolves when it receives an event with `"status": "ok"` and the same `kpi` and `check` values. Choose one of these approaches: * **Resolve in BigPanda:** operators resolve the incident in BigPanda once the issue is fixed. * **Send an `ok` event from GermainUX:** create a second HTTP Action with the same body and `"status": "ok"`, and attach it to an SLA or rule that fires when the KPI recovers. * **Resolve through the BigPanda API:** call the [Resolve Alerts](https://api-docs.bigpanda.io/resolve-alerts-37769996e0) endpoint with the BigPanda alert IDs (up to 500 alerts per request, one request per second). ## Troubleshooting | Symptom | Likely cause | Fix | | - | - | - | | `401` / `403` | Wrong or expired API key, or missing `Bearer` prefix | Check the key and the `Authorization` header format | | `400` | Invalid JSON, or a missing `app_key` / `status` | Run the action manually and review the rendered body; add `?json_string` to context values | | No data found / alert never appears | Request sent to the wrong BigPanda region | Use the base URL for your organization's region | | Template error, nothing sent | A context value is missing (for example, no `context.fact` on aggregate SLAs) | Wrap optional values in `<#if ...??>` checks, as the template does | | Connection timeout | The GermainUX Action Service can't reach BigPanda | Allow outbound HTTPS from the Action Service host to the BigPanda endpoint | | Duplicate BigPanda alerts | `kpi` or `check` values change between breaches | Keep variable data in `description`, not in the dedup fields | | Severity looks wrong | SLA severities ordered differently than the template assumes | Check the severity mapping table and adjust the status thresholds in the template | | `429` | Rate limit reached during an alert storm | Retry with backoff; use [Quiet Time](https://docs.germainux.com/main/create-an-alert.md) | ## References ### GermainUX * [BigPanda Incident Intelligence](https://docs.germainux.com/main/overview) * [Moogsoft](https://docs.germainux.com/main/moogsoft.md) (HTTP Action setup and SLA Action assignment) * [Configure Execution of HTTP Request](https://docs.germainux.com/main/configure-execution-of-http-request.md) * [HTTP and HTTPS Execution](https://docs.germainux.com/main/synthetic-http-execution.md) * [Contact GermainUX Support](https://docs.germainux.com/main/support.md) ### BigPanda * [Send alert monitoring events to BigPanda](https://api-docs.bigpanda.io/send-alert-monitoring-events-to-bigpanda-37769997e0) * [Authentication and Headers](https://docs.bigpanda.io/reference/introduction#authentication-and-headers) * [Regions and base URLs](https://api-docs.bigpanda.io/) * [Resolve Alerts](https://api-docs.bigpanda.io/resolve-alerts-37769996e0) ## Get Help > **[Contact GermainUX Support](https://docs.germainux.com/main/support.md)** > > The Germain Team can help you set this up. > **Can't find what you need?** > > Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing. The content of this document is proprietary to GERMAIN SOFTWARE. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.