Skip to main content
Use an ntopng Webhook endpoint to send ntopng alerts to Flashduty On-call. For hosts, interfaces, networks, and other entities, ntopng first sends engage (triggered) and, once the condition clears, release. Flashduty links the two messages with one Alert Key: engage creates the alert and release recovers it. Flow alerts are sent once and never released.

In Flashduty On-call

Create either a dedicated or shared ntopng alert integration and copy its complete Push URL.

Dedicated integration

  1. In the Flashduty console, select Channels and open a channel
  2. Go to Settings → Integrations → Dedicated integrations and click Add integration
  3. Select ntopng and click Save
  4. Open the integration card and copy the Push URL

Shared integration

  1. In the Flashduty console, go to Integration center → Alert events
  2. Select ntopng and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In ntopng

1

Create a Webhook endpoint in ntopng

Where: ntopng › System interface › Notifications › Endpoints › +Log in to ntopng as an administrator.
2

Create a recipient

Where: ntopng › System interface › Notifications › Recipients › +Click Check to send a test request, then click Add to save the recipient. Check only proves the URL is reachable: it sends a request with version 0.2 and empty alerts, and Flashduty creates an Info alert titled ntopng test notification. Close it manually.Recovery: when the condition of a host, interface, or network alert clears, ntopng sends release and Flashduty recovers the alert. Flow alerts have no release message; see “Recovery and testing” below.
3

Trigger a real alert and verify

Where: ntopng › AlertsTrigger a host alert (for example, let a host breach one of ntopng’s threshold checks) and confirm Flashduty shows an active alert. After the condition clears and ntopng releases the alert, confirm the Flashduty alert recovers. The checklist item “Receive the first event” is then complete as well.

Alert key

The engage and release messages for one alert carry the same interface ID (ifid), entity type (entity_id), entity value (entity_val), alert type (alert_id), and subtype (subtype). Flashduty builds the Alert Key from these five fields. ntopng itself tells engaged alerts apart by entity value, alert type, and subtype. The score (score), timestamps, host name, and check period change between messages and are not part of the Alert Key. A flow alert has action set to store and each one becomes its own alert. When ntopng resends the same flow after its conditions change, the Alert Key stays the same: it is built from the interface, alert type, VLAN, client and server IP and port, protocol, and the flow’s first-seen time. If any alert lacks alert_id, or an engage or release message lacks entity_id or entity_val, Flashduty returns a parameter error that names the field.

Status and severity

ntopng derives severity from score; Flashduty maps it as follows. A missing or non-numeric score is treated as Info.

Recovery and testing

  • release: closes the alert with the same Alert Key. The release event takes its severity from the score of that message itself (100 or more is Critical, 50 or more is Warning, otherwise Info), and its status is recovery.
  • store (flow alerts) and any alert without a release message: does not recover on its own. Turn on auto-close in the integration or channel, with a suggested duration of 24 hours.
  • Check button: ntopng sends a request with version 0.2 and an empty alerts list. Flashduty returns success and opens one Info alert titled ntopng test notification under its own Alert Key. It never merges with a real alert and does not recover on its own, so close it manually.
A request carries at most 10 alerts (ntopng’s per-request limit). Flashduty creates one event per alert and keeps the order of the request.

Troubleshooting

  • ntopng reports a delivery failure: confirm the webhook URL is complete, includes integration_key, and that the ntopng server can reach api.flashcat.cloud. ntopng retries a failed delivery 3 times
  • Flashduty returns a parameter error: check that the body is JSON and that every engage and release alert has alert_id, entity_id, and entity_val
  • An alert does not recover: flow alerts have no release message; for other alerts ntopng must release them first, so check on the ntopng Alerts page whether the alert is still engaged
  • No alerts arrive: check the recipient’s minimum severity, alert category, and entity filters, and that alert generation is enabled in ntopng
For more detail, see the Endpoints and Recipients section of the ntopng documentation.