Skip to main content
Use Contrast Security’s generic webhook to sync new vulnerabilities, closed vulnerabilities, server-offline events, and new attacks to Flashduty On-call. Each vulnerability maps to one Flashduty alert: it triggers when a new vulnerability is found and recovers automatically when the vulnerability is closed. Contrast’s generic webhook has no fixed payload; the body is the template you enter in the Payload field. Use the template below, because Flashduty parses only the fields it defines.

In Flashduty On-call

Get the push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channels and open a channel
  2. Go to Settings → Integration Data → Dedicated Integrations and click Add integration
  3. Select Contrast Security and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Contrast Security and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Contrast Security

1

Add a generic webhook in Contrast

Where: Contrast › user menu › Organization settings › Integrations › Generic webhook › Connect
2

Enter the Payload template

Where: Contrast › Organization settings › Integrations › Generic webhook › Connect › PayloadPaste the following single-line JSON into the Payload field:
Contrast replaces each $ variable with its value and sends the result as a POST. Do not add variables such as $Message or $VulnerabilityEvidence: they can contain double quotes or line breaks that break the JSON, and Flashduty then returns an invalid-parameter error.Click Add. Contrast disconnects a webhook after 5 consecutive attempts without a 2XX response; to reconnect, test and save it again. To notify organization administrators when it disconnects, go to Organization settings → Integrations → Generic webhook → Show configurations, select the connection, check Notify on disconnect and click Save.
3

Turn on the notification subscriptions

Where: Contrast › Organization settings › Notifications › Integrations dropdownIn the Integrations dropdown, select the webhook you just created, then switch on the toggle in the Integrations column for each subscription you want to send. Turn on at least the subscriptions for new vulnerabilities (NEW_VULNERABILITY) and closed vulnerabilities (VULNERABILITY_CHANGESTATUS_CLOSED); without the latter, alerts never recover. Add the SERVER_OFFLINE subscription if you want server-offline alerts.
4

Verify

  1. Produce a new vulnerability in an application running the Contrast agent and confirm Flashduty shows an active alert
  2. In Contrast, change that vulnerability’s status to a closed status (for example Remediated or Fixed) and confirm the alert recovers
Contrast has no separate test button; verification is triggering an event you subscribed to.

Events and alert key

Changes to severity, status, title, or application do not change the Alert Key. A NEW_VULNERABILITY or VULNERABILITY_CHANGESTATUS_CLOSED event without trace_id, or a SERVER_OFFLINE event without server_id, is rejected. Unrecognized event types are handled like the last row. Server-offline alerts and the events in the last row have no recovery event. Configure Auto-close after timeout (for example 24 hours) on the integration or channel, or close them manually.

Status and severity

Mapped from $Severity: When a vulnerability is closed the alert recovers and keeps the severity carried by the closing event.

Labels

Troubleshooting

  • Contrast reports the webhook as disconnected: Flashduty returned a non-2XX response. Check that the URL contains integration_key and that the Payload is the template above and valid JSON, then test and save again in Contrast
  • The alert does not recover: confirm the vulnerability moved to a closed status in Contrast. Other status changes (such as Confirmed or Suspicious) send no event
  • An extra alert appears when saving or testing: the Contrast documentation does not show what a test request contains, so Flashduty does not special-case it and handles it as an ordinary event. A test request with unsubstituted or blank variables opens a separate alert for an unrecognized event type. Close it manually after verifying
For more variables and events, see Contrast Generic Webhooks.