Skip to main content
Use the FortiMonitor (formerly Panopta) webhook integration to send incident and recovery notifications to Flashduty On-call. Each FortiMonitor incident maps to one Flashduty alert: the alert triggers when the incident starts, escalation notifications from the Alert Timeline merge into the same alert, and the alert recovers when the incident clears.

​
In Flashduty On-call

You can get the integration push URL in either of the following ways.

​
Use a dedicated integration

  1. In the Flashduty console, go to Channels and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add an integration
  3. Select FortiMonitor and click Save
  4. Open the new integration card and copy the push URL

​
Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select FortiMonitor and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routes after creation
  4. Click Save and copy the generated push URL

​
Configure FortiMonitor

1

Create a webhook integration

  1. Sign in to FortiMonitor, go to Teams & Activity → Integrations, find the Webhook card, and click Configure
  2. Enter Flashduty as the Title. You select the webhook by this name in Alert Timelines
  3. For Trigger Event, select the outage event
  4. Set Request Method to POST
  5. Paste the complete Flashduty push URL into Postback URL
  6. Set Authentication Method to None
  7. Set Payload Type to Form Variables and add the variables below, one per row. Variable names are case-sensitive; the values are FortiMonitor macros:
  1. Click Save
2

Add the clear event

In the same webhook, click Add Event, select the clear event for Trigger Event, keep every other field and variable identical to the previous step, and click Save.Without this step, Flashduty only receives incident notifications and alerts never recover automatically.
3

Use the webhook in an Alert Timeline

  1. Open the Alert Timeline you want to connect, or create one with Add → Alert Timeline
  2. Click Add New Alert Event, set how long after an incident starts to notify, and select the Flashduty webhook under integrations
  3. Make sure the instances or instance groups you want to connect use this Alert Timeline
4

Verify the lifecycle

Push a monitored metric past its threshold (for example, lower the threshold temporarily) and wait for the Alert Timeline’s notification time. Confirm that Flashduty receives an active alert, then restore the threshold and confirm that the alert recovers.
FortiMonitor sends webhook requests from fixed IP addresses: 104.197.35.194/32 and 35.185.29.9/32. If the network in front of the push URL restricts inbound traffic, allow these two addresses.
Payload Type must be Form Variables, with variable names exactly as listed above. The default Raw Payload is a Google Chat card that lacks the fields Flashduty needs, so those requests are rejected.

​
Payload

FortiMonitor POSTs the following form fields, one request per incident and event: The alert title is <instance name>: <affected metrics>. If the instance name is empty, the FQDN is used; if both are empty, the title is FortiMonitor incident <outage_id>.

​
Alert Key

Flashduty uses outage_id (the FortiMonitor incident ID) as the Alert Key. The incident, escalation, and clear notifications of one incident carry the same outage_id, so they land on the same alert. When the same metric on the same instance fails again after recovering, FortiMonitor opens a new incident ID and Flashduty opens a new alert. Changing the instance name, reason, or severity does not change the Alert Key. If a request has no outage_id, or still contains the unexpanded $outage_id, Flashduty returns a parameter error, because the clear notification could not be linked to the original alert.

​
Status and severity

Requests with an empty or unknown trigger are rejected.

​
FAQ

No. Each escalation event on the Alert Timeline sends another outage notification for the same incident with the same outage_id, and it merges into the same alert.
No. Acknowledgements and broadcast messages do not change the incident state; Flashduty returns success and leaves the alert unchanged. Acknowledge the incident in Flashduty.
The Alert Timeline sends a notification only after the incident has lasted until the configured notification time. If the incident clears before that, FortiMonitor sends no incident notification and Flashduty creates no alert.

​
Troubleshooting

  • Delivery fails: make sure the Postback URL is the complete push URL and includes integration_key. If inbound traffic is restricted, allow the FortiMonitor webhook IP addresses
  • Flashduty returns a parameter error: make sure Payload Type is Form Variables, the variable names match the table above, and trigger and outage_id are set to $trigger and $outage_id
  • The alert does not recover: make sure the webhook has a clear event with the same variables as the outage event
For macro details, see the official FortiMonitor documentation: Webhooks.