Create an Opsgenie notifier

To create an Opsgenie notifier, set up Opsgenie and then create the notifier in Palo Alto Networks Cortex XCOR. Before you begin, make sure you have your Opsgenie API key and API URL.

Set up Opsgenie

Before creating an Opsgenie notifier in Cortex XCOR, generate an API key. Refer to the Opsgenie documentation for instructions. Next, create an Opsgenie notifier in Cortex XCOR.

Create an Opsgenie notifier in Cortex XCOR

After setting up Opsgenie, you can create an Opsgenie notifier in Cortex XCOR. Select from the following methods to create an Opsgenie notifier. You can use variables in your notifiers.

Web
Chronoctl
Terraform
API

To create an Opsgenie notifier:

In the navigation menu select Alerting > Notifiers.
Click Create notifier.
Enter a descriptive name for the notifier.
Select Opsgenie as the type of notifier you want to create.
In the API Key field, enter the value of your Opsgenie API key.
In the API URL field, enter the following URL, which is called as a POST request:
https://api.opsgenie.com/
Optional: Select Notify when resolved to send a resolved alert notification.
Click Save.

To create one or more notifiers using Chronoctl, create a YAML file that defines them and apply the configuration to your instance.

You can use the notifiers scaffold command to generate an example notifier, and then copy the resource definition for your notifier type:

chronoctl notifiers scaffold

Define the resource definition for your Opsgenie notifier:
Chronoctl example
api_version: v1/config kind: Notifier spec: name: NAME slug: SLUG skip_resolved: true ops_genie: api_key: 'API_KEY' api_url: API_URL
Replace the following:
- NAME: A descriptive name, such as test-opsgenie.
- SLUG: A unique identifier, such as test-opsgenie.
- API_KEY: Your OpsGenie API key.
- API_URL: Your OpsGenie API URL.
Enter your Opsgenie API key in the api_key field.
Enter the following URL in the api_url field:
https://api.opsgenie.com/
Apply the changes:
chronoctl apply -f FILE_NAME.yaml
Replace FILE_NAME with the name of your notifier YAML file.

To create an Opsgenie notifier:

Create an Opsgenie notifier with Terraform by using the chronosphere_opsgenie_alert_notifier type followed by a name in a resource declaration:

Terraform example

resource "chronosphere_opsgenie_alert_notifier" "opsgenie_notifier" {
  name = "Opsgenie Notifier"

  # Optional slug of the Opsgenie notifier.
  slug = "opsgenie-notifier"

  ## Notifier-specific required configuration
  # Detailed definitions can be found at: https://prometheus.io/docs/alerting/latest/configuration/#opsgenie_config
  api_key = "your-api-key"

  ## Notifier-specific optional configurations
  api_url     = "your-api-url"
  message     = "custom message"
  description = "description"
  source      = "source"
  tags        = ["tag-1", "tag-2"]
  note        = "note"
  priority    = "P1"

  details = {
    "first_detail" = "interesting detail"
  }

  # Can have multiple responders.
  responder {
   # Set one of the [id, name, username] fields
    name = "Productivity Platform - Compute"
    type = "TEAM" # Or: USER, ESCALATION, SCHEDULE
  }

  ## (Optional) Base configuration common to all notifiers
  send_resolved = true # The default value

  ## (Optional) HTTP configuration common to HTTP notifiers
  basic_auth_username = "username"
  basic_auth_password = "strong+p@ssword"
  # Can use bearer_token instead of basic auth
  tls_insecure_skip_verify = false
}

Enter your Opsgenie API key in the api_key field.
Enter the following URL in the api_url field:
https://api.opsgenie.com/
Run terraform apply to create the notifier resource:
terraform apply

To complete this action with the Cortex XCOR API, use the ops_genie object in the CreateNotifier endpoint.Because the Cortex XCOR API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Cortex XCOR instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information

Set up Opsgenie

Create an Opsgenie notifier in Cortex XCOR

​Set up Opsgenie

​Create an Opsgenie notifier in Cortex XCOR

Set up Opsgenie

Create an Opsgenie notifier in Cortex XCOR