UpGuard alert integration

UpGuard is a third-party risk and attack surface management platform. Create a webhook integration in UpGuard and choose its triggers, for example a company score dropping below a threshold, a vendor score dropping within a period, or a new data leak being published. Every notification it fires is sent to Flashduty On-call. Each UpGuard notification maps to one Flashduty alert. UpGuard sends no “recovered” notification, so alerts are closed by the channel’s auto-close or manually.

Configure in UpGuard

Add a webhook integration in UpGuard

Where: UpGuard › Settings › Integrations › + New Integration › Webhook

Field	Value	Required
Triggers	Click a trigger’s pill to slide it right and enable it (for example a company score dropping below a threshold, a vendor score dropping within a period, or a new data leak being published)	Required
Name	A name for the integration	Required
Webhook URL	`{integration_url}`	Required

Then click Confirm and next.

Fill in the payload template in UpGuard

Where: UpGuard › Settings › Integrations › + New Integration › Webhook › Define payloadUpGuard renders the request body from a Liquid template. Flashduty parses the JSON rendered from the template below. Paste it as the payload of each trigger; string fields must be quoted:

{
  "notification": {
    "id": "{{ notification.id }}",
    "type": "{{ notification.type }}",
    "description": "{{ notification.description }}",
    "occurredAt": "{{ notification.occurredAt }}",
    "context": {
      "LatestScore": "{{ notification.context.LatestScore }}",
      "PrevScore": "{{ notification.context.PrevScore }}",
      "Threshold": "{{ notification.context.Threshold }}",
      "Domain": "{{ notification.context.Domain }}"
    }
  }
}

Keep id: a request without notification.id is rejected. The fields under context depend on the trigger; missing fields render empty and Flashduty ignores empty values.You can click Send test message to check connectivity. UpGuard’s documentation does not show the test message body, so Flashduty handles it like any notification: it opens an alert that you close by hand. Then click Confirm and next.

Turn on auto-close in Flashduty

Where: Flashduty console › Channels › Edit channel › Auto-resolve timeout

Field	Value	Required
Auto-resolve timeout	On, suggested duration 7 days	Optional

Turn on auto-close in the channel that receives these alerts. UpGuard sends no recovery notification, so without auto-close these alerts stay open.

Enable the integration in UpGuard and verify

Where: UpGuard › Settings › Integrations › + New Integration › Webhook › EnableClick the toggle to enable the integration, then click Finish. Then wait for a real trigger (or use Send test message from the previous step). Back in Flashduty, the integration shows a Latest event time, which means the setup works.

Event types

Payload	Effect in Flashduty
A notification from any trigger	Opens one alert with severity Warning

Alert key

Flashduty uses notification.id as the Alert Key: notifications with different ids open different alerts, and a redelivery with the same id merges into the same alert. A request without notification.id is rejected. UpGuard’s documentation does not state the scope of that id’s uniqueness, so before going live, confirm with the test message and one real trigger that two notifications carry different id values.

Status and severity

UpGuard notifications carry no severity, so every notification opens as Warning. To tell them apart, adjust the severity in the channel’s alert processing rules using the notification_type label.

Labels

Label	Source
`check`	Notification type (`notification.type`, such as `CustomerCSTARUnderThreshold`)
`notification_id`	Notification id
`notification_type`	Notification type
`occurred_at`	When the notification occurred (`occurredAt`)
`latest_score` / `previous_score` / `threshold`	Latest score, previous score and threshold (`context`)
`domain`	Related domain (`context.Domain`)

The alert title is the description (for example The score for 'Example Company' dropped below 600 with a score of 599), or the notification type when it is empty.

Notes

UpGuard notifications can carry breach and identity data. Keep the template to the fields listed above and do not add credentials or personal data
UpGuard sends requests from a fixed set of IP addresses, listed in webhook-ips.json. Allow them if an IP allowlist sits in front of Flashduty
If description contains a double quote, the rendered JSON is invalid and the request is rejected as a parameter error

Troubleshooting

Flashduty receives nothing: confirm the webhook destination is complete, includes integration_key, and the integration is enabled
Parameter error: a missing notification.id means the template dropped id; an invalid JSON message means a string field is not quoted
Alerts never close: UpGuard sends no recovery notification, so turn on the channel’s auto-close

For more information, see UpGuard’s webhook integration guide.

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

In Flashduty On-call

Use a dedicated integration

Use a shared integration