Skip to main content
Use the Custom webhook destination of GitGuardian to send secret-leak incidents to Flashduty On-call. Each GitGuardian incident maps to one Flashduty alert: a newly detected incident, a new occurrence, a change in severity or validity, or a reopened incident triggers or updates that alert, and the alert recovers when the incident is marked resolved or ignored.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select GitGuardian, then click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select GitGuardian and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

Configure GitGuardian

You need permission to manage integrations in the GitGuardian workspace.
1

Create a Custom webhook

Where: GitGuardian › Settings › Workspace › Integrations › Destinations › Custom webhookGitGuardian generates a signature token for the webhook. Flashduty authenticates by the integration_key in the Push URL and does not verify the signature, so you do not need to enter the token in Flashduty.
2

Select events

Where: GitGuardian › Settings › Workspace › Integrations › Destinations › Custom webhook › EventsOn the Events tab, enter an Events name, turn on Internal monitoring, and under Notify when select these events (or click Select all):
You must select Resolved and Ignored under Incident status change, or the Flashduty alert does not recover when the incident is handled.
Assignment, comment, feedback, access, public sharing, and Honeytoken events do not change alert state. Flashduty returns success for them and creates no alert, so you do not need to select them.To page only for high-risk leaks, add filtering rules to the webhook by severity, validity, secret type, or tag. Without rules, every incident is sent.
3

Verify the lifecycle

Where: GitGuardian › Settings › Workspace › Integrations › Destinations › Custom webhookTrigger a new incident in the workspace and confirm that Flashduty receives an active alert. Then mark the incident Resolved in GitGuardian and confirm that the alert recovers.Send test message in the webhook’s menu (the three dots on its row) only verifies that the URL is reachable: Flashduty returns success but creates no alert.

Alert key

Flashduty uses the incident id (incident.id in the webhook) as the Alert Key. In GitGuardian’s published webhook examples, the New incident, New occurrence, Resolved, Ignored, and Reopened events of the same incident carry the same incident.id. Changes to severity, validity, occurrence count, or detector name do not change the Alert Key. Incident events without incident.id are rejected.

Status and severity

The alert status follows action: incident_resolved and incident_ignored recover the alert, and every other event in the table above triggers it. A validity, severity, or risk score change on an incident that is already resolved or ignored is ignored and does not re-open the alert. A reopened incident triggers a new alert with the same Alert Key. The severity follows incident.severity: unknown means GitGuardian has not rated the incident yet, so Flashduty treats it as Warning.

Labels

Troubleshooting

  • No alert was created: confirm the matching event is selected and that the webhook’s filtering rules do not exclude the incident. GitGuardian states that webhook delivery is best effort and not guaranteed
  • The alert did not recover: confirm Resolved and Ignored are selected under Incident status change
  • Flashduty returns action is required (400): the request has no action field and its origin is not GitGuardian, so it was not sent by a GitGuardian webhook delivery; make sure the push URL is configured only on a GitGuardian Custom webhook
  • Flashduty returns incident.id is required (400): the event type needs an incident, but the request has no incident.id
  • An ignored incident is reopened: a new alert is created with the same Alert Key
For field details, see GitGuardian Custom webhook.