Event Catalog Reference
The Event Catalog contains all 96+ event types that can trigger an agent. Events are organized by source product. Each entry shows the event ID, description, filterable fields, and a sample payload.
When building a custom agent, use the Event Catalog to identify exactly which event you want to trigger on and which fields are available for filtering.
PSA — 10 Events
The most commonly used trigger source. PSA events cover the full ticket lifecycle, contract management, and invoicing.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
psa:ticket.created | Ticket Created | New ticket opened by client or technician | priority (p1–p4), type (incident/request/problem/change), client_id |
psa:ticket.updated | Ticket Updated | Ticket modified (status, assignee, notes) | status (open/in_progress/resolved/closed) |
psa:ticket.closed | Ticket Closed | Ticket closed or resolved | client_id |
psa:ticket.escalated | Ticket Escalated | Ticket escalated to higher priority or tier | escalated_to (p1–p4) |
psa:ticket.sla_warning | SLA Warning | Ticket approaching SLA deadline (30 min remaining) | minutes_remaining (number) |
psa:ticket.sla_breached | SLA Breached | Ticket missed its SLA deadline | priority (p1–p4) |
psa:ticket.assigned | Ticket Assigned | Ticket assigned or reassigned to a technician | assigned_to (string) |
psa:ticket.note_added | Note Added | Note or update added to a ticket | note_type (public/private/system) |
psa:contract.expiring_soon | Contract Expiring | Contract expires within 30 days | days_remaining (number) |
psa:invoice.overdue | Invoice Overdue | PSA invoice past its due date unpaid | days_overdue (number), amount (number) |
Most commonly used: ticket.created (Dispatch Agent, onboarding agents), ticket.sla_warning (escalation agents), contract.expiring_soon (renewal agents).
Sample payload — psa:ticket.created:
{
"ticket_id": "tkt_abc123",
"org_id": "org_xyz",
"priority": "p2",
"subject": "Server unreachable",
"type": "incident",
"created_by": "user_abc",
"client_id": "client_xyz",
"created_at": "2026-03-09T14:23:00Z"
}
Defend — 8 Events
Security detection and incident events from The One Defend EDR platform.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
defend:alert.fired | Alert Fired | Threat or behavioral anomaly detected | severity (critical/high/medium/low), mitre_tactic (string), device_id |
defend:alert.resolved | Alert Resolved | Alert resolved or marked false positive | resolution (resolved/false_positive/accepted_risk) |
defend:device.enrolled | Device Enrolled | New endpoint enrolled in Defend | platform (windows/macos/linux) |
defend:device.offline | Device Offline | Monitored endpoint stopped reporting | client_id |
defend:incident.created | Incident Created | Alert elevated to security incident | severity (critical/high/medium/low) |
defend:incident.resolved | Incident Resolved | Security incident fully remediated | — |
defend:policy.violation | Policy Violation | Device violated security policy (USB, firewall, etc.) | violation_type (string) |
defend:ransomware.detected | Ransomware Detected | Ransomware activity detected on endpoint | isolated (boolean) |
Most commonly used: alert.fired (Guardian Agent, security response agents), ransomware.detected (isolation workflows).
Sample payload — defend:alert.fired:
{
"alert_id": "alert_abc",
"org_id": "org_xyz",
"device_id": "dev_xyz",
"severity": "high",
"rule_id": "RULE-001",
"description": "Lateral movement detected",
"mitre_tactic": "TA0008",
"client_id": "client_xyz"
}
RMM — 6 Events
Device health, patch management, and script execution events from The One RMM.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
rmm:device.offline | Device Offline | RMM-monitored device stopped responding | client_id |
rmm:device.online | Device Online | RMM device came back online | client_id |
rmm:script.completed | Script Completed | Scheduled or on-demand RMM script finished | exit_code (number) |
rmm:patch.failed | Patch Failed | Patch failed to install on a device | client_id |
rmm:patch.completed | Patch Completed | Patch cycle completed on a device | patches_failed (number) |
rmm:health.degraded | Device Health Degraded | Device health score dropped below threshold | health_score (number) |
Most commonly used: device.offline (alerting agents), patch.failed (ticket creation agents), health.degraded (proactive maintenance agents).
Security — 5 Events
Vulnerability, posture, and threat intelligence events from The One Security platform.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
security:finding.new | Security Finding | New vulnerability or posture issue discovered | severity (critical/high/medium/low) |
security:posture.score_changed | Posture Score Changed | Client security posture score changed significantly | delta (number) |
security:compliance.score_dropped | Compliance Score Dropped | Client compliance score dropped below threshold | framework (string) |
security:dark_web.hit | Dark Web Hit | Client email found in a dark web breach | client_id |
security:phishing_simulation.failed | Phishing Simulation Failed | Employee clicked a phishing simulation email | client_id |
Most commonly used: finding.new (remediation ticket agents), dark_web.hit (client notification agents), compliance.score_dropped (escalation agents).
CRM — 6 Events
Deal pipeline, contact, and renewal events from The One CRM.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
crm:contact.created | Contact Created | New CRM contact added | — |
crm:deal.won | Deal Won | Deal marked closed-won | value (number) |
crm:deal.lost | Deal Lost | Deal marked closed-lost | — |
crm:contact.updated | Contact Updated | CRM contact information changed | — |
crm:stage.changed | Deal Stage Changed | Deal moved to a new pipeline stage | to_stage (string) |
crm:renewal.upcoming | Renewal Upcoming | Client contract renewal 60 days out | days_remaining (number) |
Most commonly used: deal.won (client onboarding agents), renewal.upcoming (renewal outreach agents).
Books — 4 Events
Invoice and payment events from The One Books accounting engine.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
books:invoice.created | Invoice Created | New invoice generated | amount (number) |
books:invoice.paid | Invoice Paid | Invoice paid | — |
books:invoice.overdue | Invoice Overdue | Invoice past due date | days_overdue (number) |
books:payment.failed | Payment Failed | Payment attempt failed | — |
Legal — 4 Events
Policy, compliance, and audit events from The One Legal platform.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
legal:policy.expiring | Policy Expiring | Legal policy expires within 30 days | type (string) |
legal:policy.signed | Policy Signed | Client signed a legal document | — |
legal:compliance.gap_found | Compliance Gap Found | Compliance gap identified for a client | gap_type (string) |
legal:audit.scheduled | Audit Scheduled | Compliance audit scheduled for a client | — |
On-Call — 4 Events
Incident management and paging events from The One On-Call.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
oncall:incident.created | Incident Created | New on-call incident created | severity (p1–p4) |
oncall:incident.escalated | Incident Escalated | On-call incident escalated | — |
oncall:incident.resolved | Incident Resolved | On-call incident resolved | — |
oncall:oncall.page_sent | Page Sent | On-call page sent to a technician | — |
Relay — 3 Events
Email campaign and list hygiene events from The One Relay.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
relay:campaign.sent | Campaign Sent | Email campaign completed sending | — |
relay:bounce.detected | Bounce Detected | Email hard-bounced | — |
relay:unsubscribe.processed | Unsubscribe Processed | Recipient unsubscribed from email | — |
People — 3 Events
Employee lifecycle events from The One People HR platform.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
people:employee.created | Employee Created | New employee added | role (string) |
people:employee.offboarded | Employee Offboarded | Employee marked as offboarded | — |
people:timeoff.requested | Time Off Requested | Employee submitted time-off request | — |
Most commonly used: employee.created (onboarding provisioning agents), employee.offboarded (access revocation agents).
Projects — 3 Events
Project management events from The One Projects.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
projects:project.created | Project Created | New project created | — |
projects:milestone.overdue | Milestone Overdue | Project milestone past its due date | — |
projects:task.completed | Task Completed | Project task marked complete | — |
CMDB — 3 Events
Asset and dependency events from The One CMDB.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
cmdb:asset.added | Asset Added | New asset added to CMDB | type (string) |
cmdb:asset.decommissioned | Asset Decommissioned | Asset decommissioned | — |
cmdb:asset.relationship_changed | Relationship Changed | Asset dependency changed | — |
Voice — 3 Events
Call and SMS events from The One Voice.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
voice:call.completed | Call Completed | Phone call ended | direction (inbound/outbound) |
voice:voicemail.received | Voicemail Received | Voicemail left on a managed number | — |
voice:sms.received | SMS Received | SMS received on a managed number | — |
Visitor — 3 Events
Visitor management events from The One Visitor.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
visitor:visitor.checked_in | Visitor Checked In | Visitor checked in at reception | — |
visitor:visitor.checked_out | Visitor Checked Out | Visitor checked out | — |
visitor:watchlist.hit | Watchlist Hit | Visitor matched a watchlist entry | — |
Backups — 3 Events
Backup job events from The One Backups.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
backups:backup.completed | Backup Completed | Backup job completed successfully | — |
backups:backup.failed | Backup Failed | Backup job failed | client_id |
backups:restore.completed | Restore Completed | Restore operation finished | — |
Fleet — 3 Events
Vehicle and trip events from The One Fleet.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
fleet:vehicle.maintenance_due | Maintenance Due | Fleet vehicle due for maintenance | — |
fleet:trip.completed | Trip Completed | Fleet vehicle trip ended | — |
fleet:incident.reported | Incident Reported | Fleet vehicle incident reported | — |
Mission — 3 Events
Member and giving events from The One Mission (church management).
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
mission:member.joined | Member Joined | New member joined an organization | — |
mission:giving.received | Giving Received | Donation received | amount (number) |
mission:event.registered | Event Registration | Member registered for an event | — |
Hub — 3 Events
Organization and user lifecycle events from The One Hub.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
hub:org.created | Organization Created | New MSP organization created in Hub | — |
hub:entitlement.activated | Entitlement Activated | Product entitlement activated for org | product (string) |
hub:user.invited | User Invited | New user invited to Hub | — |
Collective — 3 Events
Community and marketplace events from The MSP Collective.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
collective:post.created | Post Created | New post created in The Collective | — |
collective:vendor.joined | Vendor Joined | Vendor joined The MSP Collective | — |
collective:event.registered | Event Registration | Member registered for a Collective event | — |
Portal — 2 Events
Client portal user events from The One Portal.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
portal:user.invited | Portal User Invited | Client portal user invited | — |
portal:user.activated | Portal User Activated | Portal user activated their account | — |
Migrate — 2 Events
Data migration events from The One Migrate.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
migrate:migration.completed | Migration Completed | Data migration completed | — |
migrate:migration.failed | Migration Failed | Data migration failed | — |
Brand — 2 Events
Presentation and asset events from The One Brand.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
brand:presentation.created | Presentation Created | Brand presentation generated | — |
brand:asset.published | Asset Published | Brand asset published to portal | — |
Code — 2 Events
Code security scan events from The One Code.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
code:scan.completed | Code Scan Completed | Code security scan finished | critical (number) |
code:vulnerability.found | Vulnerability Found | Critical vulnerability discovered in code | severity (critical/high/medium/low) |
Status — 2 Events
Status page incident events from The One Status.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
status:incident.created | Status Incident Created | Status page incident created | severity (degraded/partial_outage/major_outage) |
status:incident.resolved | Status Incident Resolved | Status page incident resolved | — |
AI Platform — 2 Events
AI quota events from The One AI Platform.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
ai:quota.warning | AI Quota Warning | Organization approaching AI quota limit (80%) | quota_used_pct (number) |
ai:quota.exceeded | AI Quota Exceeded | Organization exceeded AI quota | — |
AMS — 2 Events
Account management events from The One AMS.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
ams:account.created | Account Created | New AMS client account created | — |
ams:account.suspended | Account Suspended | AMS account suspended | — |
LiveKit — 2 Events
Video and audio session events from The One LiveKit integration.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
livekit:session.started | Session Started | Video/audio session started | — |
livekit:session.ended | Session Ended | Video/audio session ended | — |
Bridge — 2 Events
Integration sync events from The One Bridge.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
bridge:sync.completed | Sync Completed | Bridge integration sync completed | — |
bridge:sync.failed | Sync Failed | Bridge integration sync failed | — |
Crawl — 2 Events
Web scan events from The One Crawl service.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
crawl:scan.completed | Crawl Scan Completed | Web crawl/scan completed | findings (number) |
crawl:finding.new | Crawl Finding | Web crawl found an issue | severity (critical/high/medium/low) |
Canvas — 1 Event
Design events from The One Canvas.
| Event | Display Name | Description | Key Filterable Fields |
|---|---|---|---|
canvas:design.published | Design Published | Canvas design published | — |