Skip to main content
Use a Sublime Security webhook Action to send messages flagged by detection rules to Flashduty On-call. One message (one message group) maps to one alert, and the alert title is the name of the highest-severity rule that flagged it. Sublime pushes only when a message is flagged and sends no resolve notification, so Flashduty alerts do not recover automatically.

In Flashduty On-call

You can get the integration push URL in either of two ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Sublime Security and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Sublime Security and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Sublime Security

1

Create a webhook Action in Sublime

Where: Sublime console › Actions › New Action › WebhookClick Save. Sublime then opens the Attach to Rules dialog, where you can select existing rules and click Attach selected rules.Sublime requires the receiver to return a 2xx response within 10 seconds, which Flashduty does. Sublime pushes only when a message is flagged and has no separate recovery setting, so Flashduty alerts do not recover on their own; see “Events and recovery” below.
2

Attach the Action to detection rules

Where: Sublime console › Detection Rules (or Automations) › rule detail page › Edit › ActionsSelect the webhook Action from the previous step in the Actions dropdown and click Save Rule. On a new account the rules from Sublime’s feed are inactive, so activate at least one rule before the webhook can fire.
3

Flag a message in Sublime and verify

Where: Sublime console › Detection Rules (or Automations) › rule detail pageSublime’s documentation does not describe a test button for webhooks, so you cannot send a test event from the console. After a message is flagged by an attached rule, confirm that an alert appears in Flashduty.

Events and recovery

Sublime sends no resolve notification. Enable auto-close on timeout for the channel, with 7 days suggested, or close alerts by hand once the message is handled.

Alert key

The Alert Key is data.message.canonical_id, or data.message.id when it is absent. Sublime documents canonical_id as the identifier of the message group a message belongs to, shared when the same message is delivered to several mailboxes. Changes to identifiers, classification, rule names or severity do not change the Alert Key. A push with neither field is rejected, and the error names the field.

Status and severity

Flashduty uses the highest severity among flagged_rules:

Labels

The push carries no subject or body; use message_id to look the message up in Sublime. Flashduty does not store the user email in actor.

Signature header

Sublime sends an X-Sublime-Signature header on every delivery, in the format t=<Unix timestamp>,v0=<HMAC signature>. The Flashduty push URL authenticates with integration_key and does not verify this header, so no extra setup is needed.

Troubleshooting

  • No alerts arrive: confirm the Action is attached to a rule and check the Action’s message group scope
  • Flashduty returns a parameter error: the push has neither data.message.canonical_id nor data.message.id, which happens for a manual trigger with no message selected
  • Alerts never close: Sublime sends no recovery, so enable auto-close on timeout for the channel
For field details, see the Sublime webhook documentation.