Create an incident.io notifier

To create an incident.io notifier, set up incident.io and then create the notifier in Palo Alto Networks Cortex XCOR.

Cortex XCOR connects to incident.io through a webhook notifier. There’s no dedicated incident.io notifier type in Cortex XCOR. You select Webhook as the type and point it at the webhook URL from your incident.io alert source.

Before you begin, make sure you have the webhook URL that incident.io provides when you create the Cortex XCOR alert source.

Set up incident.io

Before creating an incident.io notifier in Cortex XCOR, you must configure an alert source in incident.io. To configure an alert source:

In incident.io, go to Alerts.
On the Alerts page, click the Sources tab.
Click New alert source.
In the search box, enter Chronosphere to locate the Cortex XCOR alert source.
Enter a name for the alert source such as alerts, and then click Continue to create the alert source.
Copy the webhook URL that incident.io displays for the alert source. Enter this URL when you create the notifier in Cortex XCOR.

For more information, see Adding Cortex XCOR as an alert source in the incident.io documentation. Next, create an incident.io notifier in Cortex XCOR.

Create an incident.io notifier in Cortex XCOR

After setting up incident.io, you can create an incident.io notifier in Cortex XCOR. Select from the following methods to create an incident.io notifier. You can use variables in your notifiers.

Web
Chronoctl
Terraform
API

To create an incident.io notifier:

In the navigation menu select Alerting > Notifiers.
Click Create notifier.
Enter a descriptive name for the notifier, such as incident.io.
Select Webhook as the type of notifier you want to create.
In the URL field, enter the URL from your incident.io dashboard, which is called as a POST request. For example:
https://incident-io-my-url/api/public/v2/alert_events/chronosphere/01HZKELEKAMDNE8D9FNEKD
Optional: Select Notify when resolved to send a resolved alert notification.
Click Save.

To create one or more notifiers using Chronoctl, create a YAML file that defines them and apply the configuration to your instance.

You can use the notifiers scaffold command to generate an example notifier, and then copy the resource definition for your notifier type:

chronoctl notifiers scaffold

Define the resource definition for your incident.io webhook notifier:
Chronoctl example
api_version: v1/config kind: Notifier spec: name: NAME slug: SLUG skip_resolved: true webhook: url: URL
Replace the following:
- NAME: A descriptive name, such as incident-io.
- SLUG: A unique identifier, such as incident-io.
- URL: Your incident.io webhook URL, such as https://incident-io-my-url/api/public/v2/alert_events/chronosphere/01HZKELEKAMDNE8D9FNEKD
Add the URL from your incident.io dashboard, called as a POST request, to the url key.
Apply the changes:
chronoctl apply -f FILE_NAME.yaml
Replace FILE_NAME with the name of your notifier YAML file.

To create a webhook notifier for incident.io:

Create a webhook notifier with Terraform by using the chronosphere_webhook_alert_notifier type followed by a name in a resource declaration:

Terraform example

resource "chronosphere_webhook_alert_notifier" "webhook_notifier" {
  name = "incident.io notifier"

  # Optional slug of the webhook notifier.
  slug = "incident-io-notifier"

  # Notifier-specific required configuration
  # Detailed definitions can be found at: https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
  url = "https://incident-io-my-url/api/public/v2/alert_events/chronosphere/01HZKELEKAMDNE8D9FNEKD"

  ## (Optional) Base configuration common to all notifiers
  send_resolved = true # The default value

  ## (Optional) HTTP configuration common to HTTP notifiers
  basic_auth_username = "username"
  basic_auth_password = "strong+p@ssword"
  # Can use bearer_token instead of basic auth
  tls_insecure_skip_verify = false
}

Add the URL from your incident.io dashboard, called as a POST request, to the url key.
Run terraform apply to create the notifier resource.
terraform apply

To complete this action with the Cortex XCOR API, use the webhook object in the CreateNotifier endpoint.Because the Cortex XCOR API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Cortex XCOR instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

After creating your notifier, you can create a notification policy that uses the incident.io notifier you created. When you create a monitor in Cortex XCOR, select the incident.io notification policy to send alerts from Cortex XCOR to incident.io.

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information

Set up incident.io

Create an incident.io notifier in Cortex XCOR

​Set up incident.io

​Create an incident.io notifier in Cortex XCOR

Set up incident.io

Create an incident.io notifier in Cortex XCOR