> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an incident.io notifier

> Create an incident.io notifier with Palo Alto Networks Cortex XCOR.

To create an incident.io notifier, set up incident.io and then create the notifier in
Palo Alto Networks Cortex XCOR.

<Note>
  Cortex XCOR connects to incident.io through a **webhook** notifier. There's no
  dedicated incident.io notifier type in Cortex XCOR. You select
  **Webhook** as the type and point it at the webhook URL from your incident.io alert
  source.
</Note>

Before you begin, make sure you have the webhook URL that incident.io provides when
you create the Cortex XCOR alert source.

## Set up incident.io

Before creating an incident.io notifier in Cortex XCOR, you must configure
an alert source in incident.io.

To configure an alert source:

1. In incident.io, go to **[Alerts](https://app.incident.io/~/alerts/sources)**.
2. On the **Alerts** page, click the **Sources** tab.
3. Click **New alert source**.
4. In the search box, enter **Chronosphere** to locate the Cortex XCOR alert source.
5. Enter a name for the alert source such as **alerts**, and then click
   **Continue** to create the alert source.
6. Copy the webhook URL that incident.io displays for the alert source. Enter
   this URL when you create the notifier in Cortex XCOR.

For more information, see
[Adding Cortex XCOR as an alert source](https://docs.incident.io/alerts/chronosphere)
in the incident.io documentation.

Next, [create an incident.io notifier](#create-an-incidentio-notifier-in-cortex-xcor)
in Cortex XCOR.

## Create an incident.io notifier in Cortex XCOR

After [setting up incident.io](#set-up-incidentio), you can create an incident.io
notifier in Cortex XCOR.

Select from the following methods to create an incident.io notifier. You can use
[variables](/investigate/alerts/notifications/notifiers#use-variables-in-notifiers) in your
notifiers.

<Tabs>
  <Tab title="Web" id="create-incident-notifier">
    To create an incident.io notifier:

    1. In the navigation menu select
       **<Icon icon="bell" /> Alerting <span aria-label="and then">></span> Notifiers**.

    2. Click **Create notifier**.

    3. Enter a descriptive name for the notifier, such as **incident.io**.

    4. Select **Webhook** as the type of notifier you want to create.

    5. In the **URL** field, enter the URL from your incident.io dashboard, which is
       called as a `POST` request. For example:

       ```text theme={null}
       https://incident-io-my-url/api/public/v2/alert_events/chronosphere/01HZKELEKAMDNE8D9FNEKD
       ```

    6. Optional: Select **Notify when resolved** to send a resolved alert notification.

    7. Click **Save**.
  </Tab>

  <Tab title="Chronoctl" id="incident-chronoctl">
    To create one or more notifiers using [Chronoctl](/tooling/chronoctl), create a YAML file
    that defines them and apply the configuration to your instance.

    <Note>
      You can use the `notifiers scaffold` command to generate an example notifier, and
      then copy the resource definition for your notifier type:

      ```shell theme={null}
      chronoctl notifiers scaffold
      ```
    </Note>

    1. Define the resource definition for your incident.io webhook notifier:

       ```yaml Chronoctl example icon="square-terminal" /NAME/ /SLUG/ /URL/ theme={null}
       api_version: v1/config
       kind: Notifier
       spec:
         name: NAME
         slug: SLUG
         skip_resolved: true
         webhook:
           url: URL
       ```

       Replace the following:

       * *`NAME`*: A descriptive name, such as `incident-io`.
       * *`SLUG`*: A unique identifier, such as `incident-io`.
       * *`URL`*: Your incident.io webhook URL, such as `https://incident-io-my-url/api/public/v2/alert_events/chronosphere/01HZKELEKAMDNE8D9FNEKD`

    2. Add the URL from your incident.io dashboard, called as a `POST` request, to the
       `url` key.

    3. Apply the changes:

       ```shell /FILE_NAME/ theme={null}
       chronoctl apply -f FILE_NAME.yaml
       ```

       Replace *`FILE_NAME`* with the name of your notifier YAML file.
  </Tab>

  <Tab title="Terraform" id="incident-terraform">
    To create a webhook notifier for incident.io:

    1. Create a webhook notifier with [Terraform](/tooling/infrastructure/terraform) by using the
       `chronosphere_webhook_alert_notifier` type followed by a name in a resource
       declaration:

       ```terraform Terraform example icon="square-terminal" theme={null}
       resource "chronosphere_webhook_alert_notifier" "webhook_notifier" {
         name = "incident.io notifier"

         # Optional slug of the webhook notifier.
         slug = "incident-io-notifier"

         # Notifier-specific required configuration
         # Detailed definitions can be found at: https://prometheus.io/docs/alerting/latest/configuration/#webhook_config
         url = "https://incident-io-my-url/api/public/v2/alert_events/chronosphere/01HZKELEKAMDNE8D9FNEKD"

         ## (Optional) Base configuration common to all notifiers
         send_resolved = true # The default value

         ## (Optional) HTTP configuration common to HTTP notifiers
         basic_auth_username = "username"
         basic_auth_password = "strong+p@ssword"
         # Can use bearer_token instead of basic auth
         tls_insecure_skip_verify = false
       }
       ```

    2. Add the URL from your incident.io dashboard, called as a `POST` request, to the
       `url` key.

    3. Run `terraform apply` to create the notifier resource.

       ```shell theme={null}
       terraform apply
       ```
  </Tab>

  <Tab title="API" id="incident-API">
    To complete this action with the Cortex XCOR API, use the `webhook` object in the
    [`CreateNotifier`](/tooling/api-info/definition/operations/CreateNotifier) endpoint.

    Because the Cortex XCOR API requires authentication, include an API token with your
    `curl` request, as shown in the following example. For more details, see
    [Create an API token](/tooling/api-info#create-an-api-token).

    ```shell /"TOKEN"/ /INSTANCE/ /METHOD/ /ENDPOINT_PATH/ theme={null}
    export CHRONOSPHERE_API_TOKEN="TOKEN"
    export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

    curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
         -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"
    ```

    Replace the following:

    * *`TOKEN`*: Your API token.
    * *`INSTANCE`*: The subdomain name for your organization's Cortex XCOR instance.
    * *`METHOD`*: The HTTP method to use with the request, such as `GET` or `POST`.
    * *`ENDPOINT_PATH`*: The specific endpoint you want to access.
  </Tab>
</Tabs>

After creating your notifier, you can
[create a notification policy](/investigate/alerts/notifications/policies#create-a-notification-policy)
that uses the incident.io notifier you created.

When you [create a monitor](/investigate/alerts/monitors#create-a-monitor) in Cortex XCOR, select the incident.io notification policy to send alerts from Cortex XCOR to incident.io.


## Related topics

- [Notifiers](/investigate/alerts/notifications/notifiers.md)
- [Integrate with Cortex XCOR](/integrate.md)
- [Respond to incidents](/overview/guides/incident-response.md)
- [CreateNotifier](/tooling/api-info/definition/operations/CreateNotifier.md)
- [Create an email notifier](/investigate/alerts/notifications/notifiers/email.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.