Overview#
When a threshold breach fires at 02:00, nobody should have to manually open Jira, page the on-call engineer, and log a ServiceNow ticket by hand. The Incident Auto-Creation & Integration Hub does that automatically: it watches platform events, creates a structured incident, and fans it out to Jira, PagerDuty, ServiceNow, and any webhook endpoint simultaneously. State changes in any of those tools sync back, so the team always works from a single, consistent incident record regardless of which tool they opened first.
The module operates through an event bus architecture that decouples incident detection from incident management, enabling organisations to connect any combination of external platforms while maintaining a single source of truth within Argus.
Key Features#
- Automated Incident Creation -- Platform events including threshold breaches, anomaly detections, compliance violations, and system health alerts automatically generate structured incidents with severity classification, affected assets, and recommended response actions
- Event Bus Architecture -- A publish-subscribe event system enables loosely coupled integration between detection systems and response platforms, supporting fan-out to multiple destinations and guaranteed delivery with retry logic
- Jira Integration -- Bidirectional synchronisation with Jira creates issues in configurable projects with custom field mapping, status transitions, priority alignment, and comment threading between Argus and Jira
- PagerDuty Integration -- Real-time incident escalation through PagerDuty with severity mapping, on-call schedule awareness, acknowledgment sync, and resolution tracking back to the originating Argus incident
- ServiceNow Integration -- Create and update ServiceNow incidents with full CMDB correlation, assignment group routing, SLA tracking, and knowledge article linking for accelerated resolution
- Webhook Integrations -- Configurable webhook endpoints with customisable payloads, authentication headers, retry policies, and response validation for integration with any HTTP-capable system
- Integration Configuration Management -- Per-tenant integration profiles with credential management, field mapping templates, connection health monitoring, and automated failover between primary and backup endpoints
- Incident Correlation -- Automatically group related incidents based on temporal proximity, affected assets, root cause analysis, and event source correlation to reduce alert fatigue
Use Cases#
- Security Operations -- Automatically create incidents from threat detections and route them to the appropriate security team through PagerDuty escalation while maintaining a parallel record in ServiceNow for compliance tracking
- Infrastructure Monitoring -- Convert system health alerts into Jira tickets assigned to the responsible infrastructure team with full context including affected services, performance metrics, and suggested remediation steps
- Compliance Incident Management -- Generate compliance incidents from regulatory violations with automatic routing to the compliance team, audit trail preservation, and reporting package generation for supervisory authorities
- Cross-Platform Operations -- Maintain synchronised incident records across multiple operational tools, ensuring that resolution actions taken in any platform are reflected everywhere and no incidents fall through the cracks
Integration#
The hub connects to all Argus platform event sources including alert management, anomaly detection, compliance monitoring, and system health. Outbound integrations support Jira Cloud and Server, PagerDuty Events API v2, ServiceNow REST API, and arbitrary webhook endpoints. All integration traffic is encrypted in transit and authenticated with per-integration credentials stored in the secrets management system.
Open Standards#
- CloudEvents 1.0 (CNCF): Every incident lifecycle event is wrapped in a CloudEvents 1.0 envelope (
specversion: "1.0",application/cloudevents+jsoncontent type) before being persisted to the unified timeline and fanned out over pub/sub channels. - GraphQL (June 2018 specification): All incident queries, mutations, and real-time subscriptions are exposed through a GraphQL API, including bidirectional sync operations and a live incident subscription stream.
- HMAC-SHA256 (RFC 2104 / FIPS 198-1): Outbound webhook deliveries are signed with HMAC-SHA256; the computed digest is sent in the
X-Webhook-Signature-256: sha256=<hex>header so receivers can verify payload authenticity. - HTTP Basic Authentication (RFC 7617): Connections to both the Jira REST API v3 and the ServiceNow REST Table API are authenticated with Base64-encoded credentials sent in the
Authorization: Basicheader. - JSON Web Tokens (RFC 7519): Inbound incident-creation requests from CAD/dispatch systems carry a service-token JWT whose
organization_idclaim is validated and matched to the request body before any incident is created. - ISO 8601 / RFC 3339 date-time format: All timestamp fields across incident records, CloudEvents envelopes, webhook payloads, and integration sync logs are serialised as ISO 8601 extended strings (e.g.
2026-06-05T12:00:00+00:00). - JSON (RFC 8259): Incident event payloads, webhook request bodies, and all REST API exchanges with Jira, ServiceNow, and PagerDuty use JSON as the canonical data-interchange format.
Availability#
- Enterprise Plan: Full integration hub with all platform connectors included
- Professional Plan: Webhook integration included; Jira, PagerDuty, and ServiceNow connectors available as add-ons
Last Reviewed: 2026-03-02 Last Updated: 2026-04-14