> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashcat.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Open Falcon Integration

> Sync Open-Falcon alert events to Flashduty via webhook to achieve automated alert noise reduction

Sync Open-Falcon alert events to Flashduty via webhook to achieve automated alert noise reduction.

<div class="hide">
  ## In Flashduty

  ***

  You can obtain an integration push URL through either of these two methods:

  ### Using Private Integration

  Choose this simpler option when you don't need to route alert events to different channels.

  <details>
    <summary>Expand</summary>

    1. Go to Flashduty console, select **Channel**, and enter a channel's details page
    2. Select the **Integrations** tab, click **Add Integration** to enter the integration page
    3. Choose **Falcon** integration, click **Save** to generate a card
    4. Click the generated card to view the **push URL**, copy it for later use. Done.
  </details>

  ### Using Shared Integration

  Choose this option when you need to route alerts to different channels based on the alert event's payload information.

  <details>
    <summary>Expand</summary>

    1. Go to Flashduty console, select **Integration Center=>Alert Events** to enter the integration selection page
    2. Select **Falcon** integration:
       * **Integration Name**: Define a name for this integration
    3. Configure the default route and select the corresponding channel (after the integration is created, you can go to `Route` to configure more routing rules)
    4. Click **Save** and copy the newly generated **push URL** for later use
    5. Done
  </details>
</div>

## In Falcon

***

Configure webhooks for each alert rule.

<div class="md-block">
  1. Log in to your Falcon console, select Templates to enter the alert rule template list page
  2. Open any alert rule template, fill in the callback address with the integration's push URL
  3. Click the Save button to save the alert rule
  4. Repeat steps 2 and 3 for all alert rule templates that need to send events

  <img alt="drawing" width="600" src="https://download.flashcat.cloud/open-falcon-tmpls.png" />

  <img alt="drawing" width="600" src="https://download.flashcat.cloud/saas-open-falcon-rule.png" />

  Similarly, you can configure the same push URL for Expressions alert rules.

  5. Return to the integration list, if the latest event time is displayed, the configuration is successful and events are being received
  6. Done
</div>

## Status Mapping

***

<div class="md-block">
  Open-Falcon to Flashduty alert severity mapping:

  | Open-Falcon | Flashduty | Status   |
  | ----------- | --------- | -------- |
  | 0           | Critical  | Critical |
  | 1           | Critical  | Critical |
  | 2           | Warning   | Warning  |
  | 3           | Warning   | Warning  |
  | 4           | Info      | Info     |
  | 5           | Info      | Info     |
  | 6           | Info      | Info     |
</div>