Skip to main content
Use a Flowtriq Webhook alert channel to send DDoS attack events to Flashduty On-call. Each attack (a Flowtriq incident) maps to one Flashduty alert: it triggers when an attack is detected, updates while the attack continues and its peak traffic changes, and recovers automatically when the attack ends (resolved automatically or manually).

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Flowtriq, then click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Flowtriq and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

Configure Flowtriq

1

Add a Webhook alert channel in Flowtriq

Where: Flowtriq console › Alert ChannelsAdd a channel of type Webhook (a trial account includes one free alert channel):
2

Save the channel and send a test event

Where: Flowtriq console › Alert Channels
  1. After saving the channel, click Test on it. Flowtriq sends a test event; Flashduty returns success and does not create an alert. This only proves the URL is reachable and does not replace a real event
  2. If you use a Flowtriq escalation policy, add the Webhook channel to the relevant step. Without a policy, all channels fire as soon as an event occurs
3

Verify a real event

Trigger attack detection on a monitored node. Confirm that Flashduty receives an active alert, and that the alert recovers automatically when the attack ends.After a few seconds, go back to Flashduty. If the integration shows a Latest event time, the setup works.
Flowtriq retries a failed delivery up to 3 times (after 10 seconds, 60 seconds, and 5 minutes). Each request times out after 10 seconds, and a non-2xx status code counts as a failure.

Events and recovery

Flowtriq posts to the webhook on every incident event. The event type is in event_type: Other event types, including any Flowtriq adds later, create no alert; Flashduty returns success for them.

Alert key

Flashduty builds the Alert Key from the incident identity: incident.uuid when present, otherwise incident.id. Webhook deliveries currently carry the numeric incident.id and no uuid. The start and end events of one attack share one Alert Key, so the end event recovers the matching alert. An event with neither field is rejected. Changes to the title, severity, or peak traffic do not change the Alert Key.

Status and severity

A recovery event keeps the last severity from the attack.

Labels

The alert description comes from Flowtriq’s AI summary (ai_summary). The attack_start delivery carries no summary, so the description is empty at that point.

Troubleshooting

  • Flowtriq shows a failed delivery: confirm the URL is complete, includes integration_key, and uses HTTPS. Failed deliveries are listed in the notification log on the incident detail page in Flowtriq
  • The alert did not recover: confirm the Flowtriq channel sent an attack_end event. Recovery relies on the start and end events carrying the same incident.id; if an alert stays open for a long time, close it manually in Flashduty
  • The test succeeded but no alert appeared: test events create no alert, which is expected
For field details, see the Flowtriq webhook documentation.