Sync Open-Falcon alert events to Flashduty via webhook to achieve automated alert noise reduction.In Flashduty#
You can obtain an integration push URL through either of these two methods:Using Private Integration#
Choose this simpler option when you don't need to route alert events to different channels.Expand
1.
Go to Flashduty console, select Channel, and enter a channel's details page
2.
Select the Integrations tab, click Add Integration to enter the integration page
3.
Choose Falcon integration, click Save to generate a card
4.
Click the generated card to view the push URL, copy it for later use. Done.
Using Shared Integration#
Choose this option when you need to route alerts to different channels based on the alert event's payload information.Expand
1.
Go to Flashduty console, select Integration Center=>Alert Events to enter the integration selection page
2.
Select Falcon integration:Integration Name: Define a name for this integration
3.
Configure the default route and select the corresponding channel (after the integration is created, you can go to Route to configure more routing rules)
4.
Click Save and copy the newly generated push URL for later use
In Falcon#
Configure webhooks for each alert rule.1.
Log in to your Falcon console, select Templates to enter the alert rule template list page
2.
Open any alert rule template, fill in the callback address with the integration's push URL
3.
Click the Save button to save the alert rule
4.
Repeat steps 2 and 3 for all alert rule templates that need to send events
Similarly, you can configure the same push URL for Expressions alert rules.5.
Return to the integration list, if the latest event time is displayed, the configuration is successful and events are being received
Status Mapping#
Open-Falcon to Flashduty alert severity mapping:
| Open-Falcon | Flashduty | Status |
|---|
| 0 | Critical | Critical |
| 1 | Critical | Critical |
| 2 | Warning | Warning |
| 3 | Warning | Warning |
| 4 | Info | Info |
| 5 | Info | Info |
| 6 | Info | Info |
