Skip to main content
Use a Sysdig Monitor Webhook notification channel to send alert events to Flashduty On-call. Each time a Sysdig alert fires, it maps to one Flashduty alert: Sysdig sends ACTIVE when the alert triggers and when it renotifies, and sends OK when the alert condition clears, which recovers the alert. For alerts segmented with Segment by, each segment maps to its own Flashduty alert.

​
In Flashduty On-call

You can obtain an integration push URL in either of the following ways.

​
Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add an integration
  3. Select Sysdig, then click Save
  4. Open the generated integration card and copy the Push URL

​
Use a shared integration

  1. In the Flashduty console, select Integration Center → Alert Events
  2. Select Sysdig and enter an integration name
  3. Configure the default route and select a channel; after creation, add more rules under Route if needed
  4. Click Save and copy the generated Push URL

​
Configure Sysdig Monitor

Creating a notification channel requires administrator privileges in Sysdig Monitor.
1

Create a Webhook notification channel

  1. Log in to Sysdig Monitor as an administrator and go to Integrations → Notification Channels (Settings → Notification Channels in some versions)
  2. Click Add Notification Channel and select Webhook. Do not select Custom Webhook: Flashduty parses the fixed format of the Webhook channel
  3. Fill in the fields as follows:
  1. Click Save
2

Use the channel in alert rules

  1. Go to Alerts and create or edit an alert rule
  2. In the notification settings (Notify), select the Webhook channel created in the previous step
  3. If the alert rule overrides this channel’s notification options, make sure resolve notifications are not turned off
  4. Save the alert rule
3

Verify

  1. When you save the notification channel, Sysdig sends a test notification named TEST ALERT: Testing Notification Channel <channel name>. Flashduty returns success but does not create an alert
  2. Make an alert rule that uses the channel fire, and confirm that Flashduty receives an active alert
  3. Wait for the alert condition to clear, and confirm that the alert recovers

​
Alert Key

Flashduty uses the Sysdig event ID (event.id) as the Alert Key. Sysdig creates one event each time an alert fires, and the first notification, renotifications, and the resolve notification of that event all carry the same event ID, so they merge into one alert, which the resolve notification recovers.
  • Segmented alerts: Sysdig sends a separate notification for each segment that fires, and each segment has its own event ID, so each segment is a separate Flashduty alert that recovers on its own
  • Firing again: when a rule fires again after it resolved, Sysdig creates a new event and Flashduty creates a new alert
  • Changes to the alert name, severity, metric value, and time do not change the Alert Key. Requests without event.id are rejected

​
Status and severity

state sets the status: The alert rule’s severity (alert.severity, 0 to 7) sets the alert severity. If it is missing, Flashduty uses alert.severityLabel: A recovered alert keeps the severity of its last trigger.

​
Labels

The alert description is the Sysdig notification body (alert.body), which includes the metric value, segment, and trigger time.

​
Troubleshooting

  • Flashduty returns a parameter error: make sure the URL is complete and includes integration_key, and that the channel type is Webhook, not Custom Webhook
  • No alert after saving the channel: this is expected. The test notification does not create an alert; use a real alert to verify
  • The alert does not recover: make sure the channel has Notify when Resolved on and that the alert rule does not turn off resolve notifications for this channel
  • One rule creates several alerts: the alert rule uses Segment by, and each segment fires and recovers on its own. This is expected
  • Sysdig disabled the notification channel: after repeated 4xx responses, Sysdig puts the channel under observation and disables it after several failures. After fixing the URL, re-enable the channel in Sysdig manually
This integration accepts Sysdig Monitor alert notifications only. Sysdig Secure Webhook notifications (runtime policies, vulnerabilities, and so on) use a different format and are not supported at this URL. For field details, see Sysdig Webhook notification channel.