Linking Squadcast as a source

Alpha release

This source is currently in alpha. The interface and available tables may change.

The Squadcast (SolarWinds Incident Response) connector syncs your incident response and on-call data into PostHog, so you can analyze incidents, postmortems, and reliability metrics like MTTA and MTTR alongside your product data.

Prerequisites

You need a Squadcast account and a refresh token. The token inherits your user role, so connect with an account that can read the teams and resources you want to sync.

Adding a data source

In PostHog, go to the Sources tab of the data pipeline section.
Click + New source and click Link next to this source.
Enter your credentials (see Configuration below) and click Next.
Select the tables you want to sync, choose a sync method and frequency, then click Import.

Once the syncs are complete, you can start querying this data in PostHog.

When linking Squadcast, you'll need:

Refresh token – generate one from your Squadcast profile page (Profile → Refresh Token). PostHog exchanges it for a short-lived access token on each sync.
Region – pick the region your Squadcast account lives in (US or EU).

Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
Incremental – only new or updated rows are synced on each run, using a cursor field (such as an updated_at timestamp). Cheaper than a full refresh, but deletes aren't captured.
Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See sync methods for a full explanation of how each mode works and how to choose between them.

Incidents and postmortems support incremental sync windowed on their creation date. Changes to incidents created before the incremental cursor (for example a later status change) are only picked up by a full refresh.

Configuration

Option	Type	Required
`Refresh token`	password	Yes
`Region`	select	Yes

Supported tables

Table	Description	Sync method	Incremental field	Primary key
`incidents`	An incident triggered on a Squadcast service, pulled from the incident export with its lifecycle timestamps and response metrics.	Incremental, Full refresh	created_at	—
`postmortems`	A postmortem (retrospective) written for an incident.	Incremental, Full refresh	created_at	—
`services`	A service monitored in Squadcast that incidents are triggered against.	Full refresh	—	—
`escalation_policies`	An escalation policy defining who is notified about an incident and in what order.	Full refresh	—	—
`schedules`	An on-call schedule (v4 schedules API) defining who is on call for a team.	Full refresh	—	—
`runbooks`	A runbook of steps responders can attach to and follow during an incident.	Full refresh	—	—
`slos`	A service level objective tracked in Squadcast, with its error budget and health.	Full refresh	—	—
`users`	A user in the Squadcast organization.	Full refresh	—	—
`teams`	A team in the Squadcast organization, with its members and roles.	Full refresh	—	—

Team-scoped tables (incidents, services, escalation policies, schedules, runbooks, SLOs, and postmortems) are synced for every team your account can access, and each row includes a team_id column identifying the owning team. Teams your account can't read are skipped.

Troubleshooting

If your refresh token is invalid or expired, generate a new one from your Squadcast profile page, then reconnect.
If some teams' data is missing, your user role may not have access to those teams. Reconnect with an account that can read them, or ask an admin to grant access.

If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.