Continuous Operations Events

Continuous Operations events are related to the operation of services deployed in target environments.

Subjects

This specification defines two subjects in this stage: incident and ticket. Events associated to these subjects can be generated by a number of different actors, such as the end-user, an SRE, a quality gate, a monitoring system, or the service itself.

Subject	Description	Predicates
incident	A problem in a production environment	detected, reported, resolved
ticket	A ticket in a ticketing system	created, updated, closed

incident

An incident represents a problem in a production environment. To quote the definition of the term from the NIST glossary, an incident is:

An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

Field	Type	Description	Examples
id	String	See id	04896C75-F34D-40FF-A584-3F2B71CB9D47, issue123, risk-CVE123
source	URI-Reference	See source	region1/production, monitoring-system/metricA
description	String	Short, free style description of the incident	Response time above 10ms, New CVE-123 detected
environment	Object (environment)	Reference to the environment	{"id": "production"}, {"id": "staging"}, {"id": "prod123", "source": "iaas-region-1"}
service	Object (service)	Reference to the service	{"id": "service123"}, {"id": "service123", "source": "region1/k8s/namespace"}
artifactId	Purl	Identifier of the artifact deployed with this service	0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427, 927aa808433d17e315a258b98e2f1a55f8258e0cb782ccb76280646d0dbe17b5, six-1.14.0-py2.py3-none-any.whl

ticket

A ticket can request a change, report a problem, or document an incident. Any fields not defined by this spec may be included as customData.

Field	Type	Description	Examples
id	String	See id	04896C75-F34D-40FF-A584-3F2B71CB9D47, ticket123, risk-CVE123
source	URI-Reference	See source	ticketing-system
summary	String	The summary provided on the ticket	Implement feature xyz, New CVE-123 detected
ticketType	Enum or String	The ticket type	bug, enhancement, incident, task, question, custom-value
group	String	The group or project the ticket is currently assigned to	backend
creator	String	The ticket author	Alice
assignees	List (string)	Who is currently investigating the ticket	[Bob]
priority	Enum or String	An indicator of the importance of the ticket	high, medium, low, custom-value
labels	List (string)	Labels associated to the ticket	[productxyz, bug]
milestone	String	An ID that represents a goal for when this ticket is to be completed	123, sprint-123, Q1
uri	URI-Reference	A link to the ticket itself	https://example.issues.com/ticket123
resolution	Enum or String	Indicates the closing status of the ticket	completed, withdrawn, custom-value
updatedBy	String	The person who updated the ticket	Bob

Events

incident detected

This event represents an incident that has been detected by a system or human.

• Event Type: dev.cdevents.incident.detected.0.3.0
• Predicate: detected
• Subject: incident

Field	Type	Description	Examples	Mandatory ✅
id	String	See id	04896C75-F34D-40FF-A584-3F2B71CB9D47, ticket123, risk-CVE123	✅
source	URI-Reference	See source	region1/production, monitoring-system/metricA
description	String	Short, free style description of the incident	Response time above 10ms, New CVE-123 detected
environment	Object (environment)	Reference to the environment	{"id": "production"}, {"id": "staging"}, {"id": "prod123", "source": "iaas-region-1"}	✅
service	Object (service)	Reference to the service	{"id": "service123"}, {"id": "service123", "source": "region1/k8s/namespace"}
artifactId	Purl	Identifier of the artifact deployed with this service	0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427, 927aa808433d17e315a258b98e2f1a55f8258e0cb782ccb76280646d0dbe17b5, six-1.14.0-py2.py3-none-any.whl

incident reported

This event represents an incident that has been reported through a ticketing system. Compared to the detected predicated, it introduces a ticket URI.

• Event Type: dev.cdevents.incident.reported.0.3.0
• Predicate: reported
• Subject: incident

Field	Type	Description	Examples	Mandatory ✅
id	String	See id	04896C75-F34D-40FF-A584-3F2B71CB9D47, ticket123, risk-CVE123	✅
source	URI-Reference	See source	region1/production, monitoring-system/metricA
description	String	Short, free style description of the incident	Response time above 10ms, New CVE-123 detected
environment	Object (environment)	Reference to the environment	{"id": "production"}, {"id": "staging"}, {"id": "prod123", "source": "iaas-region-1"}	✅
ticketURI	URI	URI of the ticket	example.issues.com/ticket123	✅
service	Object (service)	Reference to the service	{"id": "service123"}, {"id": "service123", "source": "region1/k8s/namespace"}
artifactId	Purl	Identifier of the artifact deployed with this service	0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427, 927aa808433d17e315a258b98e2f1a55f8258e0cb782ccb76280646d0dbe17b5, six-1.14.0-py2.py3-none-any.whl

incident resolved

This event represents an incident that has been resolved, meaning that the problem identified by the incident has been solved or recalled.

• Event Type: dev.cdevents.incident.resolved.0.3.0
• Predicate: resolved
• Subject: incident

Field	Type	Description	Examples	Mandatory ✅
id	String	See id	04896C75-F34D-40FF-A584-3F2B71CB9D47, issue123, risk-CVE123	✅
source	URI-Reference	See source	region1/production, monitoring-system/metricA
description	String	Short, free style description of the incident resolution	Response time restored below 10ms, CVE-123 acknowledged as non-exploitable
environment	Object (environment)	Reference to the environment	{"id": "production"}, {"id": "staging"}, {"id": "prod123", "source": "iaas-region-1"}	✅
service	Object (service)	Reference to the service	{"id": "service123"}, {"id": "service123", "source": "region1/k8s/namespace"}
artifactId	Purl	Identifier of the artifact deployed with this service	0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427, 927aa808433d17e315a258b98e2f1a55f8258e0cb782ccb76280646d0dbe17b5, six-1.14.0-py2.py3-none-any.whl

ticket created

This event represents a ticket that has been created within some ticketing system.

• Event Type: dev.cdevents.ticket.created.0.2.0
• Predicate: created
• Subject: ticket

Field	Type	Description	Examples	Mandatory ✅
id	String	See id	ticket-123	✅
source	URI-Reference	See source	ticketing-system
summary	String	The summary provided on the ticket	Implement feature xyz, New CVE-123 detected	✅
ticketType	Enum or String	The ticket type	bug, enhancement, incident, task, question, custom-value
creator	String	The ticket author	Alice	✅
group	String	The group the ticket is currently assigned to	backend
assignees	List (string)	Who is currently investigating the ticket	[Bob]
priority	Enum or String	An indicator of the importance of the ticket	high, medium, low, custom-value
labels	List (string)	Labels associated to the ticket	[productxyz, bug]
milestone	String	An ID that represents a goal for when this ticket is to be completed	123, sprint-123, Q1
uri	URI-Reference	A link to the ticket itself	https://example.issues.com/ticket123	✅

ticket updated

This event indicates that a ticket has been updated within some ticketing system.

• Event Type: dev.cdevents.ticket.updated.0.2.0
• Predicate: updated
• Subject: ticket

Field	Type	Description	Examples	Mandatory ✅
id	String	See id	ticket-123	✅
source	URI-Reference	See source	ticketing-system
summary	String	The summary provided on the ticket	Implement feature xyz, New CVE-123 detected
ticketType	Enum or String	The ticket type	bug, enhancement, incident, task, question, custom-value
creator	String	The ticket author	Alice
group	String	The group the ticket is currently assigned to	backend
assignees	List (string)	Who is currently investigating the ticket	[Bob]
priority	Enum or String	An indicator of the importance of the ticket	high, medium, low, custom-value
labels	List (string)	Labels associated to the ticket	[productxyz, bug]
milestone	String	An ID that represents a goal for when this ticket is to be completed	123, sprint-123, Q1
uri	URI-Reference	A link to the ticket itself	https://example.issues.com/ticket123	✅
updatedBy	String	The person who authored the updates	Bob

ticket closed

This event indicates that a ticket has been closed or resolved within some ticketing system.

• Event Type: dev.cdevents.ticket.closed.0.2.0
• Predicate: closed
• Subject: ticket

Field	Type	Description	Examples	Mandatory ✅
id	String	See id	ticket-123	✅
source	URI-Reference	See source	ticketing-system
summary	String	The summary provided on the ticket	Implement feature xyz, New CVE-123 detected
ticketType	Enum or String	The ticket type	bug, enhancement, incident, task, question, custom-value
creator	String	The ticket author	Alice
group	String	The group the ticket is currently assigned to	backend
assignees	List (string)	Who is currently investigating the ticket	[Bob]
priority	Enum or String	An indicator of the importance of the ticket	high, medium, low, custom-value
labels	List (string)	Labels associated to the ticket	[productxyz, bug]
milestone	String	An ID that represents a goal for when this ticket is to be completed	123, sprint-123, Q1
uri	URI-Reference	A link to the ticket itself	https://example.issues.com/ticket123	✅
updatedBy	String	The person who authored the updates	Bob
resolution	Enum or String	Indicates the closing status of the ticket	completed, withdrawn, duplicate, custom-value	✅