Create a Slack notifier

To create a Slack notifier, set up Slack and then create the notifier in Palo Alto Networks Cortex XCOR. Before you begin, make sure you have the incoming webhook API URL from Slack.

Set up Slack

Before creating a Slack notifier in Cortex XCOR, create an incoming webhook in Slack. See Sending messages using incoming webhooks in the Slack documentation for more information. Next, create a Slack notifier in Cortex XCOR.

Create a Slack notifier in Cortex XCOR

After setting up Slack, you can create a Slack notifier in Cortex XCOR. Select from the following methods to create a Slack notifier. You can use variables in your notifiers.

Web
Chronoctl
Terraform
API

To create a Slack notifier:

In the navigation menu select Alerting > Notifiers.
Click Create notifier.
Enter a descriptive name for the notifier.
Select Slack as the type of notifier you want to create.
In the API URL field, enter the URL you created for your webhook in Slack, which is called as a POST request. For example:
https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXX
The API URL from Slack contains the channel name.
In the Channel field, enter any channel name. This field is required for backward compatibility, but its value is ignored. The destination channel is set by the webhook you entered in the API URL field.
Optional: In the Username field, enter the Slack username to post the notifier as.
Optional: Select Notify when resolved to send a resolved alert notification.
Click Save.

To create one or more notifiers using Chronoctl, create a YAML file that defines them and apply the configuration to your instance.

You can use the notifiers scaffold command to generate an example notifier, and then copy the resource definition for your notifier type:

chronoctl notifiers scaffold

Define the resource definition for your Slack notifier:
Chronoctl example
api_version: v1/config kind: Notifier spec: name: NAME slug: SLUG skip_resolved: true slack: actions: null api_url: https://hooks.slack.com/services/ channel: CHANNEL fields: null mrkdwn_in: null username: USERNAME
Replace the following:
- NAME: A descriptive name, such as test-slack.
- SLUG: A unique identifier, such as team-slack.
- CHANNEL: Required for backward compatibility, but ignored. The destination channel comes from the api_url webhook.
- USERNAME: Send the notification message from a specified Slack username.
Enter the URL you created for your webhook in Slack as the value for the api_url field. The API URL contains the channel to send the message to.
Optional: Enter the Slack username to post the notifier as in the username field.
Apply the changes:
chronoctl apply -f FILE_NAME.yaml
Replace FILE_NAME with the name of your notifier YAML file.

To create a Slack notifier:

Create a Slack notifier with Terraform by using the chronosphere_slack_alert_notifier type followed by a name in a resource declaration:

Terraform example

resource "chronosphere_slack_alert_notifier" "slack_notifier" {
  name = "Slack Notifier"

  # Optional slug of the slack notifier.
  slug = "slack-notifier"

  ## Notifier-specific required configuration.
  # For detailed definitions, see
  # https://prometheus.io/docs/alerting/latest/configuration/#slack_config
  # `api_url` is a sensitive value. Treat it like a secret.
 api_url       = "https://hooks.slack.com/services/XXXXX/XXXXX/XXXXX"
 # Required for backward compatibility, but ignored. The destination channel
 # comes from api_url.
 channel       = "alerts"

  ## Notifier-specific optional configurations
  username      = "alertbot"
  callback_id   = "my_callback_id"
  color         = "red"
  fallback      = "my_fallback"
  footer        = "my_footer"
  icon_emoji    = ""
  image_url     = "https://example.com/images/img.png"
  link_names    = false
  mrkdwn_in     = []
  pretext       = "my_pretext"
  short_fields  = false
  text          = "my_text"
  title         = "my_title"
  title_link    = "my_title_link"

  # Can have multiple fields.
  fields {
    title = "my_title"
    value = "my_value"
    short = true
  }

  # Optional list of actions
  action {
    name                        = "my_action"
    style                       = "my_style"
    text                        = "my_text"
    type                        = "my_type"
    url                         = "my_url"
    value                       = "my_value"
    action_confirm_text         = "confirmation text"
    action_confirm_tile         = "confirmation title"
    action_confirm_ok_text      = "confirmation ok text"
    action_confirm_dismiss_text = "dismissal text"
  }

  ## (Optional) Base configuration common to all notifiers
  send_resolved = true # The default value

  ## (Optional) HTTP configuration common to HTTP notifiers
  basic_auth_username = "username"
  basic_auth_password = "strong+p@ssword"
  # Can use bearer_token instead of basic auth
  tls_insecure_skip_verify = false
}

Enter the URL you created for your webhook in Slack as the value for the api_url field. The API URL sets the channel to send the message to. The channel field is required for backward compatibility, but its value is ignored.
Optional: Enter the Slack username to post the notifier as in the username field.
Run terraform apply to create the notifier resource.
terraform apply

To complete this action with the Cortex XCOR API, use the slack object in the CreateNotifier endpoint.Because the Cortex XCOR API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Cortex XCOR instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information

Set up Slack

Create a Slack notifier in Cortex XCOR

​Set up Slack

​Create a Slack notifier in Cortex XCOR

Set up Slack

Create a Slack notifier in Cortex XCOR