Skip to main content
Use a Panther Custom Webhook alert destination to send alerts from rules, policies and other detections to Flashduty On-call. Each Panther alert maps to one Flashduty alert. Panther delivers an alert to a destination once and sends no status-change or resolve notification, so Flashduty alerts do not recover on their own. Turn on auto-close for the channel.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. Open the Flashduty console, choose Channels, and open a channel
  2. Choose Settings → Integrations → Dedicated integrations, then click Add integration
  3. Choose Panther and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. Open the Flashduty console and choose Integration Center → Alert events
  2. Choose Panther and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Panther

1

Create the Custom Webhook destination in Panther

Where: Panther Console › Alert Destinations › Create New (or +Add your first Destination) › Custom WebhookThen click Add Destination.Panther sends an HTTP POST with a JSON body, expects a 2XX response, and retries up to 10 times on failure. The Flashduty push URL carries its own credential, so no custom HTTP header is needed.
2

Send a test alert from Panther and confirm

Where: Panther Console › Alert Destinations › Create New › Custom Webhook › Add Destination › Send Test AlertOn the final page, click Send Test Alert. The Panther documentation does not show the body of the test request, so Flashduty handles it as an ordinary alert: it opens an alert under the request’s alertId. It is not linked to any real alert and no recovery follows, so close it manually once you see it.You can also wait for a detection to match (or re-dispatch an alert from its details page in Panther, which needs Allow Manual Dispatch) and confirm Flashduty receives the alert.Go back to Flashduty. If the integration shows a Latest event time, the setup works.Panther sends no resolve notification. For the channel that receives Panther alerts, turn on auto-close. A duration of 24 hours is a reasonable start; adjust it to how fast your team handles these alerts.

Alert key

Flashduty uses the alertId field of the body as the Alert Key. Panther describes it as “Identifier of the alert in Panther Backend”. Manually re-sending the same Panther alert from its details page lands on the same Flashduty alert. Changes to the title, severity or description do not change the Alert Key. A request without alertId returns a parameter error.

Status and severity

The Panther Custom Webhook has no status field, so every delivery is a trigger event. Alert labels carry the detection name, detection ID (id), alert ID, alert type, raw severity, alert link and tags. alertContext is defined by the detection author and may hold raw log fields, so it is not copied into the alert; runbook is not copied either.

Troubleshooting

  • Panther shows a delivery failure: confirm the push URL is complete and includes integration_key; Panther retries up to 10 times when Flashduty returns a non-2XX response
  • No alert arrives: confirm the destination’s Severity Levels, Default Alert Types and Log Types cover the alert, and check the detection’s destination routing
  • An alert never closes: Panther sends no resolve notification, so turn on auto-close for the channel
  • A test alert appears: it comes from Send Test Alert and is handled as an ordinary alert; close it manually
For more details, see the Panther documentation Custom Webhook Destination.