Skip to main content
Use the Semgrep AppSec Platform webhook integration to send newly detected code issues (SAST, SCA, secrets) and supply chain incidents to Flashduty On-call. Each finding becomes one Flashduty alert, and each supply chain incident that affects your projects becomes one Flashduty alert.

In Flashduty On-call

You can get the integration push URL in either of two ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Semgrep and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Semgrep and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Semgrep

You need admin access to Semgrep AppSec Platform.
1

Create a webhook integration

Where: Semgrep AppSec Platform › Settings › Integrations › Add › WebhookClick Subscribe when done.
2

Turn notifications on in a policy

Where: Semgrep AppSec Platform › Rules & Policies › Remediation › + Create automationCreate or edit a policy in Unified Policies:To receive supply chain incidents, find the Early notification for Supply Chain incidents policy on the same page (Rules & Policies › Remediation), turn it on, and select the same webhook integration.
3

Test and verify in Semgrep

Where: Semgrep AppSec Platform › Settings › Integrations
  1. Click Test next to the webhook integration and confirm Flashduty returns success. The test posts [{"text":"Test Notification","username":"Semgrep"}]; Flashduty returns success and opens a separate Info alert titled “Semgrep test notification” that you close by hand. The test only proves connectivity
  2. Commit code that matches a rule and run a scan, then confirm Flashduty receives a new alert

Payloads and recovery

Semgrep sends three kinds of objects, and one request can carry several: Semgrep sends a finding only the first time it is detected and never sends update or fixed notifications, so Flashduty alerts do not recover automatically. Turn on the channel’s auto-resolve timeout (7 days suggested), or close alerts by hand after the issue is fixed.

Alert key

The Alert Key is computed from the object type and the ID above, so a repeated delivery of the same finding merges, and a finding ID never merges with an incident ID that has the same number. Changes to the rule name or severity do not change the Alert Key. An object without its ID causes the whole request to be rejected.

Status and severity

A finding’s severity is a number derived from the rule severity: Supply chain incidents that affect your projects are always Critical.

Labels

Findings: Supply chain incidents: Every alert carries source=semgrep and event_type (finding or supply_chain_incident). The alert description is the rule’s message; code snippets are not sent.

Troubleshooting

  • Flashduty returns an invalid-parameter error: check that the webhook URL is complete and includes integration_key; the error is also returned when a finding lacks numeric_id or an incident lacks incident_id
  • No alerts arrive: check that the policy has a Call a webhook action; Semgrep notifies only the first time a finding is detected, so existing findings are not re-sent
  • Alerts never close: Semgrep sends no recovery notification, so turn on the channel’s auto-resolve timeout
  • Too many alerts: raise the severity or confidence filter in the Semgrep policy
For more details, see the Semgrep webhooks documentation.