Skip to content

Commit beadf8a

Browse files
ysyneuysyneu
authored
Merge pull request #670 from flashcatcloud/feat/alert-batch9-test
docs(alert): add batch-9 alert integration pages (test sync)
2 parents 7a7f147 + 7407ed5 commit beadf8a

28 files changed

Lines changed: 3251 additions & 2 deletions

‎docs.json‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1692,13 +1692,17 @@
16921692
"zh/on-call/integration/alert-integration/alert-sources/gitguardian",
16931693
"zh/on-call/integration/alert-integration/alert-sources/rollbar",
16941694
"zh/on-call/integration/alert-integration/alert-sources/coralogix",
1695+
"zh/on-call/integration/alert-integration/alert-sources/uptimeobserver",
1696+
"zh/on-call/integration/alert-integration/alert-sources/rbltracker",
16951697
"zh/on-call/integration/alert-integration/alert-sources/dash0",
16961698
"zh/on-call/integration/alert-integration/alert-sources/elastic",
16971699
"zh/on-call/integration/alert-integration/alert-sources/honeycomb",
16981700
"zh/on-call/integration/alert-integration/alert-sources/mongodb-atlas",
16991701
"zh/on-call/integration/alert-integration/alert-sources/honeybadger",
17001702
"zh/on-call/integration/alert-integration/alert-sources/prtg",
17011703
"zh/on-call/integration/alert-integration/alert-sources/netdata",
1704+
"zh/on-call/integration/alert-integration/alert-sources/stackrox",
1705+
"zh/on-call/integration/alert-integration/alert-sources/honeycomb",
17021706
"zh/on-call/integration/alert-integration/alert-sources/axiom",
17031707
"zh/on-call/integration/alert-integration/alert-sources/checkmk",
17041708
"zh/on-call/integration/alert-integration/alert-sources/auvik",
@@ -1709,6 +1713,7 @@
17091713
"zh/on-call/integration/alert-integration/alert-sources/bugsnag",
17101714
"zh/on-call/integration/alert-integration/alert-sources/raygun",
17111715
"zh/on-call/integration/alert-integration/alert-sources/librenms",
1716+
"zh/on-call/integration/alert-integration/alert-sources/last9",
17121717
"zh/on-call/integration/alert-integration/alert-sources/observium",
17131718
"zh/on-call/integration/alert-integration/alert-sources/icinga",
17141719
"zh/on-call/integration/alert-integration/alert-sources/sensu",
@@ -1720,6 +1725,7 @@
17201725
"zh/on-call/integration/alert-integration/alert-sources/sematext",
17211726
"zh/on-call/integration/alert-integration/alert-sources/uptrends",
17221727
"zh/on-call/integration/alert-integration/alert-sources/fortimonitor",
1728+
"zh/on-call/integration/alert-integration/alert-sources/searchstax",
17231729
"zh/on-call/integration/alert-integration/alert-sources/hetrixtools",
17241730
"zh/on-call/integration/alert-integration/alert-sources/mackerel",
17251731
"zh/on-call/integration/alert-integration/alert-sources/thousandeyes",
@@ -1765,7 +1771,15 @@
17651771
"zh/on-call/integration/alert-integration/alert-sources/open-falcon",
17661772
"zh/on-call/integration/alert-integration/alert-sources/uptime-kuma",
17671773
"zh/on-call/integration/alert-integration/alert-sources/statuscake",
1774+
"zh/on-call/integration/alert-integration/alert-sources/monitive",
1775+
"zh/on-call/integration/alert-integration/alert-sources/netbeez",
1776+
"zh/on-call/integration/alert-integration/alert-sources/simple-observability",
1777+
"zh/on-call/integration/alert-integration/alert-sources/xitoring",
1778+
"zh/on-call/integration/alert-integration/alert-sources/odown",
1779+
"zh/on-call/integration/alert-integration/alert-sources/tideways",
17681780
"zh/on-call/integration/alert-integration/alert-sources/wormly",
1781+
"zh/on-call/integration/alert-integration/alert-sources/flowtriq",
1782+
"zh/on-call/integration/alert-integration/alert-sources/obkio",
17691783
"zh/on-call/integration/alert-integration/alert-sources/langsmith",
17701784
"zh/on-call/integration/alert-integration/alert-sources/tideways",
17711785
"zh/on-call/integration/alert-integration/alert-sources/nodeping",
@@ -1830,7 +1844,8 @@
18301844
"zh/on-call/integration/alert-integration/alert-sources/lark-alert",
18311845
"zh/on-call/integration/alert-integration/alert-sources/wecom-alert",
18321846
"zh/on-call/integration/alert-integration/alert-sources/ghost-inspector",
1833-
"zh/on-call/integration/alert-integration/alert-sources/monte-carlo"
1847+
"zh/on-call/integration/alert-integration/alert-sources/monte-carlo",
1848+
"zh/on-call/integration/alert-integration/alert-sources/limacharlie"
18341849
]
18351850
},
18361851
{
@@ -3172,13 +3187,17 @@
31723187
"en/on-call/integration/alert-integration/alert-sources/gitguardian",
31733188
"en/on-call/integration/alert-integration/alert-sources/rollbar",
31743189
"en/on-call/integration/alert-integration/alert-sources/coralogix",
3190+
"en/on-call/integration/alert-integration/alert-sources/uptimeobserver",
3191+
"en/on-call/integration/alert-integration/alert-sources/rbltracker",
31753192
"en/on-call/integration/alert-integration/alert-sources/dash0",
31763193
"en/on-call/integration/alert-integration/alert-sources/elastic",
31773194
"en/on-call/integration/alert-integration/alert-sources/honeycomb",
31783195
"en/on-call/integration/alert-integration/alert-sources/mongodb-atlas",
31793196
"en/on-call/integration/alert-integration/alert-sources/honeybadger",
31803197
"en/on-call/integration/alert-integration/alert-sources/prtg",
31813198
"en/on-call/integration/alert-integration/alert-sources/netdata",
3199+
"en/on-call/integration/alert-integration/alert-sources/stackrox",
3200+
"en/on-call/integration/alert-integration/alert-sources/honeycomb",
31823201
"en/on-call/integration/alert-integration/alert-sources/axiom",
31833202
"en/on-call/integration/alert-integration/alert-sources/checkmk",
31843203
"en/on-call/integration/alert-integration/alert-sources/auvik",
@@ -3189,6 +3208,7 @@
31893208
"en/on-call/integration/alert-integration/alert-sources/bugsnag",
31903209
"en/on-call/integration/alert-integration/alert-sources/raygun",
31913210
"en/on-call/integration/alert-integration/alert-sources/librenms",
3211+
"en/on-call/integration/alert-integration/alert-sources/last9",
31923212
"en/on-call/integration/alert-integration/alert-sources/observium",
31933213
"en/on-call/integration/alert-integration/alert-sources/icinga",
31943214
"en/on-call/integration/alert-integration/alert-sources/sensu",
@@ -3200,6 +3220,7 @@
32003220
"en/on-call/integration/alert-integration/alert-sources/sematext",
32013221
"en/on-call/integration/alert-integration/alert-sources/uptrends",
32023222
"en/on-call/integration/alert-integration/alert-sources/fortimonitor",
3223+
"en/on-call/integration/alert-integration/alert-sources/searchstax",
32033224
"en/on-call/integration/alert-integration/alert-sources/hetrixtools",
32043225
"en/on-call/integration/alert-integration/alert-sources/mackerel",
32053226
"en/on-call/integration/alert-integration/alert-sources/thousandeyes",
@@ -3245,7 +3266,15 @@
32453266
"en/on-call/integration/alert-integration/alert-sources/open-falcon",
32463267
"en/on-call/integration/alert-integration/alert-sources/uptime-kuma",
32473268
"en/on-call/integration/alert-integration/alert-sources/statuscake",
3269+
"en/on-call/integration/alert-integration/alert-sources/monitive",
3270+
"en/on-call/integration/alert-integration/alert-sources/netbeez",
3271+
"en/on-call/integration/alert-integration/alert-sources/simple-observability",
3272+
"en/on-call/integration/alert-integration/alert-sources/xitoring",
3273+
"en/on-call/integration/alert-integration/alert-sources/odown",
3274+
"en/on-call/integration/alert-integration/alert-sources/tideways",
32483275
"en/on-call/integration/alert-integration/alert-sources/wormly",
3276+
"en/on-call/integration/alert-integration/alert-sources/flowtriq",
3277+
"en/on-call/integration/alert-integration/alert-sources/obkio",
32493278
"en/on-call/integration/alert-integration/alert-sources/langsmith",
32503279
"en/on-call/integration/alert-integration/alert-sources/tideways",
32513280
"en/on-call/integration/alert-integration/alert-sources/nodeping",
@@ -3310,7 +3339,8 @@
33103339
"en/on-call/integration/alert-integration/alert-sources/lark-alert",
33113340
"en/on-call/integration/alert-integration/alert-sources/wecom-alert",
33123341
"en/on-call/integration/alert-integration/alert-sources/ghost-inspector",
3313-
"en/on-call/integration/alert-integration/alert-sources/monte-carlo"
3342+
"en/on-call/integration/alert-integration/alert-sources/monte-carlo",
3343+
"en/on-call/integration/alert-integration/alert-sources/limacharlie"
33143344
]
33153345
},
33163346
{

‎en/on-call/integration/alert-integration/alert-sources/flowtriq.mdx‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
title: "Flowtriq alert integration"
3+
description: "Send DDoS attack events detected by Flowtriq to Flashduty On-call through a Webhook alert channel."
4+
keywords: ["alert integration", "Flowtriq", "webhook", "DDoS", "DDoS detection", "attack alerts"]
5+
---
6+
7+
Use a Flowtriq Webhook alert channel to send DDoS attack events to Flashduty On-call. Each attack (a Flowtriq incident) maps to one Flashduty alert: it triggers when an attack is detected, updates while the attack continues and its peak traffic changes, and recovers automatically when the attack ends (resolved automatically or manually).
8+
9+
<div className="hide">
10+
11+
## In Flashduty On-call
12+
---
13+
14+
You can obtain an integration push URL in either of the following ways.
15+
16+
### Use a dedicated integration
17+
18+
1. In the Flashduty console, select **Channel** and open a channel
19+
2. Select **Configuration** → **Integrations** → **Private integration**, then click **Add an integration**
20+
3. Select **Flowtriq**, then click **Save**
21+
4. Open the generated integration card and copy the **Push URL**
22+
23+
### Use a shared integration
24+
25+
1. In the Flashduty console, select **Integration Center → Alert Events**
26+
2. Select **Flowtriq** and enter an integration name
27+
3. Configure the default route and select a channel; after creation, add more rules under **Route** if needed
28+
4. Click **Save** and copy the generated **Push URL**
29+
30+
</div>
31+
32+
## Configure Flowtriq
33+
---
34+
35+
<Steps>
36+
<Step title="Add a Webhook alert channel">
37+
38+
1. Sign in to the Flowtriq console and go to **Alert Channels**
39+
2. Add a channel of type **Webhook** and enter the full Flashduty push URL in **URL** (HTTPS, including `integration_key`)
40+
3. Leave **Secret** empty. When a secret is set, Flowtriq adds an HMAC-SHA256 signature in the `X-Flowtriq-Signature` header; Flashduty authenticates the request by the `integration_key` in the URL and does not verify that signature
41+
42+
</Step>
43+
44+
<Step title="Save and test">
45+
46+
1. After saving the channel, click **Test** on it. Flowtriq sends a `test` event; Flashduty returns success and does not create an alert
47+
2. If you use a Flowtriq escalation policy, add the Webhook channel to the relevant step. Without a policy, all channels fire as soon as an event occurs
48+
49+
</Step>
50+
51+
<Step title="Verify a real event">
52+
53+
Trigger attack detection on a monitored node (for example, the synthetic attack event from `ftagent --test` in the Flowtriq quick start). Confirm that Flashduty receives an active alert, and that the alert recovers automatically when the attack ends.
54+
55+
</Step>
56+
</Steps>
57+
58+
Flowtriq retries a failed delivery up to 3 times (after 10 seconds, 60 seconds, and 5 minutes). Each request times out after 10 seconds, and a non-2xx status code counts as a failure.
59+
60+
## Events and recovery
61+
---
62+
63+
Flowtriq posts to the webhook on every incident event. The event type is in `event_type`:
64+
65+
| `event_type` | Meaning | Effect in Flashduty |
66+
| :--- | :--- | :--- |
67+
| `attack_start` | An attack is detected and a new incident opens | Triggers an alert |
68+
| `attack_update` | The attack is ongoing and its peak PPS/BPS is updated | Updates the same alert |
69+
| `attack_end` | The attack is resolved (automatically or manually) | Recovers the alert |
70+
| `test` | Manual test from the console | Creates no alert and returns success |
71+
72+
Other event types, including any Flowtriq adds later, create no alert; Flashduty returns success for them.
73+
74+
## Alert Key
75+
---
76+
77+
Flashduty builds the Alert Key from `incident.uuid`. The start, update, and end events of one attack share one Alert Key, so the end event recovers the matching alert. Flowtriq's own PagerDuty channel also uses the incident UUID as its deduplication key and resolves the incident when the attack ends. When `incident.uuid` is missing, `incident.id` is used; an event with neither is rejected. Changes to the title, severity, or peak traffic do not change the Alert Key.
78+
79+
## Severity mapping
80+
---
81+
82+
| `incident.severity` | Flashduty severity |
83+
| :--- | :--- |
84+
| `critical` | Critical |
85+
| `high`, `medium` | Warning |
86+
| `low` | Info |
87+
| Empty or any other value | Warning |
88+
89+
A recovery event keeps the last severity from the attack.
90+
91+
## Labels
92+
---
93+
94+
| Label | Source |
95+
| :--- | :--- |
96+
| `event` | Event type of this delivery |
97+
| `incident_uuid` / `incident_id` | UUID and numeric ID of the incident |
98+
| `attack_family` | Attack type, such as `udp_flood` |
99+
| `severity_raw` | Original Flowtriq severity |
100+
| `peak_pps` / `peak_bps` | Peak packet rate and bit rate |
101+
| `source_ip_count` | Number of attack source IPs |
102+
| `host` / `resource` | Name and IP of the attacked node |
103+
| `url` | Link to the incident in Flowtriq |
104+
105+
The alert description comes from Flowtriq's AI summary (`ai_summary`).
106+
107+
## Troubleshooting
108+
---
109+
110+
- **Flowtriq shows a failed delivery**: confirm the URL is complete, includes `integration_key`, and uses HTTPS. Failed deliveries are listed in the notification log on the incident detail page in Flowtriq
111+
- **The alert did not recover**: confirm the Flowtriq channel sent an `attack_end` event. Recovery relies on the start and end events carrying the same `incident.uuid`; if an alert stays open for a long time, close it manually in Flashduty
112+
- **The test succeeded but no alert appeared**: `test` events create no alert, which is expected
113+
114+
For field details, see the [Flowtriq webhook documentation](https://flowtriq.com/docs?section=webhooks).

‎en/on-call/integration/alert-integration/alert-sources/last9.mdx‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
title: "Last9 Alert Integration"
3+
description: "Receive Last9 alerts through Last9's webhook notification channel using a Flashduty PagerDuty integration; resolve notifications close the alert automatically."
4+
keywords: ["alert integration", "Last9", "webhook", "PagerDuty", "observability"]
5+
---
6+
7+
Last9's webhook notification channel sends PagerDuty Events API v2 JSON to the URL you enter, with fields such as `event_action`, `dedup_key` and `payload`. The Flashduty [PagerDuty integration](/en/on-call/integration/alert-integration/alert-sources/pagerduty) accepts this format, so no separate Last9 integration is needed: create a PagerDuty integration in Flashduty and paste its push URL into Last9.
8+
9+
<div className="hide">
10+
11+
## In Flashduty On-call
12+
---
13+
14+
Get an integration push URL in either of the two ways below. **Choose the PagerDuty integration type** in both, not Last9.
15+
16+
### Use a dedicated integration
17+
18+
1. In the Flashduty console, go to **Channels** and open a channel
19+
2. Go to **Settings** → **Integrations** → **Dedicated integrations** and click **Add an integration**
20+
3. Select **PagerDuty** and click **Save**
21+
4. Open the generated integration card and copy the **Push URL**, in the form `https://api.flashcat.cloud/event/push/alert/pagerduty?integration_key=<integration key>`
22+
23+
### Use a shared integration
24+
25+
1. In the Flashduty console, go to **Integration Center → Alert Events**
26+
2. Select **PagerDuty** and enter an integration name
27+
3. Configure the default route and select a channel; you can add more rules under **Routes** after creation
28+
4. Click **Save** and copy the generated **Push URL**
29+
30+
</div>
31+
32+
## Configure in Last9
33+
---
34+
35+
1. In Last9, go to **Notification Channels** and click **Add Channel** → **Webhook**
36+
2. Enter the full push URL copied above as the webhook URL, including `?integration_key=...`
37+
3. Save, and assign the channel to the Alert Groups that should notify it
38+
39+
Last9 detects URLs for Microsoft Teams, Flock, Google Chat, Telegram, Jira and Zenduty and switches to their own formats. A Flashduty push URL is not one of them, so Last9 sends the generic format described here.
40+
41+
## Field mapping
42+
---
43+
44+
| Last9 field | Flashduty |
45+
| :--- | :--- |
46+
| `dedup_key` | Alert Key. Events with the same `dedup_key` belong to one alert |
47+
| `event_action` | `trigger` and `acknowledge` create or update the alert with the severity from `payload.severity`; `resolve` closes it |
48+
| `payload.summary` | Alert title |
49+
| `payload.severity` | `critical`, `error` → Critical; `warning` → Warning; `info` → Info |
50+
| `payload.source` | Labels `source` and `resource` |
51+
| `payload.component`, `group`, `class` | Label of the same name |
52+
| `payload.custom_details` | Each key becomes a label |
53+
| `links`, `images` | Labels keyed by the link text (or `link_N`, `img_N`) |
54+
55+
## Recovery and deduplication
56+
---
57+
58+
- When Last9 sends a notification with `event_action` set to `resolve`, Flashduty closes the alert with the same `dedup_key`.
59+
- `severity` must be one of `critical`, `error`, `warning`, `info`; Flashduty rejects other values.
60+
- `trigger` and `acknowledge` events must include `payload`; a `resolve` event with only `dedup_key` is accepted.
61+
- Last9's documentation does not describe test-button behavior. After the first setup, verify with a real alert that both the trigger and the recovery show up in Flashduty.
62+
63+
## Troubleshooting
64+
---
65+
66+
- **Flashduty returns `Invalid parameters`**: the push URL is incomplete and lacks `integration_key`, or the integration type is not PagerDuty
67+
- **Alerts do not recover**: confirm Last9 sent a `resolve` notification and that its `dedup_key` matches the trigger

0 commit comments

Comments
 (0)