Classify Events Using a Classification Key

Go to
Settings
OBJECTS SETUP
Incidents
Classification & Mapping
.
Click
New
and select
Incident Classifier
.
Under
Get data
, select from where you want to pull the information based on which you will classify the incident types.
Pull from instance - select an existing integration instance.
Select schema - when supported by the integration, this will pull all of the fields for the integration from the database from which you can select by which to classify the events.
Upload JSON - upload a formatted JSON file which includes the field by which you want to classify.
Under
Select Instance
, select the instance from where you want to choose the value.
Under
Fetched data
select the value by which you want to classify the events.
Drag values from the
Unmapped Values
column to the relevant incident type on the right.
You can optionally choose a default incident type for unclassified incidents from
Direct unclassified events to: Select
.

Click
Save
.
Go to
Settings
INTEGRATIONS
Instances
.
Select the integration to which you want to apply the classifier.
In the integration settings, under
Classifier
, select the classifier you created and click
Done
.