Skip to main content
Use a Sysdig Monitor Webhook notification channel to send alert events to Flashduty On-call. Each time a Sysdig alert fires, it maps to one Flashduty alert: Sysdig sends ACTIVE when the alert triggers and when it renotifies, and sends OK when the alert condition clears, which recovers the alert. For alerts segmented with Segment by, each segment maps to its own Flashduty alert.

​
In Flashduty On-call

You can get the integration push URL in either of the following ways.

​
Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Sysdig, then click Save
  4. Open the generated integration card and copy the Push URL

​
Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Sysdig and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

​
Configure Sysdig Monitor

Creating a notification channel requires administrator privileges in Sysdig Monitor.
1

Create a webhook notification channel in Sysdig Monitor

Where: Sysdig Monitor › Integrations › Notification Channels › Add Notification Channel › WebhookIn some versions the entry is Settings › Notification Channels. Choose Webhook, not Custom Webhook: Flashduty parses the fixed format of the Webhook channel.Click Save.
2

Use the channel in a Sysdig Monitor alert

Where: Sysdig Monitor › AlertsCreate or edit an alert and select the webhook channel from the previous step in its notification settings (Notify). If the alert sets notification options for this channel individually, make sure recovery notifications are not turned off. Save the alert.
3

Verify

Where: Sysdig Monitor › Integrations › Notification Channels › Add Notification Channel › Webhook
  1. With Test notification turned on in that form, Sysdig, when you save the channel, sends a test notification named TEST ALERT: Testing Notification Channel <channel name>. Flashduty returns success but does not create an alert; it only proves the URL is reachable
  2. Let an alert that uses this channel fire and confirm Flashduty receives an active alert
  3. Wait for the alert condition to clear and confirm the original alert recovers

​
Alert key

Flashduty uses the Sysdig event ID (event.id) as the Alert Key. Sysdig creates one event each time an alert fires, and the first notification, renotifications, and the resolve notification of that event all carry the same event ID, so they merge into one alert, which the resolve notification recovers.
  • Segmented alerts: Sysdig sends a separate notification for each segment that fires, and each segment has its own event ID, so each segment is a separate Flashduty alert that recovers on its own
  • Firing again: when a rule fires again after it resolved, Sysdig creates a new event and Flashduty creates a new alert
  • Changes to the alert name, severity, metric value, and time do not change the Alert Key. Requests without event.id are rejected

​
Status and severity

state sets the status: The alert rule’s severity (alert.severity, 0 to 7) sets the alert severity. If it is missing, Flashduty uses alert.severityLabel: A recovered alert keeps the severity of its last trigger.

​
Labels

The alert description is the Sysdig notification body (alert.body), which includes the metric value, segment, and trigger time.

​
Troubleshooting

  • Flashduty returns a parameter error: make sure the URL is complete and includes integration_key, and that the channel type is Webhook, not Custom Webhook
  • No alert after saving the channel: this is expected. The test notification does not create an alert; use a real alert to verify
  • The alert does not recover: make sure the channel has Notify when Resolved on and that the alert rule does not turn off resolve notifications for this channel
  • One rule creates several alerts: the alert rule uses Segment by, and each segment fires and recovers on its own. This is expected
  • Sysdig disabled the notification channel: after repeated 4xx responses, Sysdig puts the channel under observation and disables it after several failures. After fixing the URL, re-enable the channel in Sysdig manually
This integration accepts Sysdig Monitor alert notifications only. Sysdig Secure Webhook notifications (runtime policies, vulnerabilities, and so on) use a different format and are not supported at this URL. For field details, see Sysdig Webhook notification channel.