# Alerts from other tools

> Open StatusTick incidents from alerts your other tools send: one webhook URL per source, for generic JSON, Alertmanager, Grafana, Datadog, Sentry or CloudWatch.

An alert source turns alerts from another tool into StatusTick incidents. Admins add alert sources in **Settings → Alert sources**. Each source has a secret webhook URL, a default severity and a **format**: how StatusTick reads what the tool sends.

An alert opens an incident, or updates the open incident with the same key. A resolved alert resolves it. Incidents from alerts go through the same acknowledge, escalation and notification steps as monitor incidents.

Keep the webhook URL secret: anyone with it can open incidents. If it leaks, make a new one on the alert source.

## Generic JSON

Choose **Generic JSON** for scripts and tools that let you shape the body. `POST` a JSON object to the URL:

```json
{
  "title": "CPU above 90% on web-1",
  "status": "firing",
  "severity": "high",
  "dedup_key": "cpu-web-1",
  "description": "5-minute average is 94%.",
  "links": ["https://grafana.example.com/d/abc"]
}
```

`status` is `firing` or `resolved`. Alerts with the same `dedup_key` (or, without one, the same title) update one open incident.

## Prometheus Alertmanager

Set the format to **Prometheus Alertmanager**. In `alertmanager.yml`, add a receiver with the webhook URL and route alerts to it:

```yaml
receivers:
  - name: statustick
    webhook_configs:
      - url: "https://webhook.statustick.com/v1/alerts/<token>"
        send_resolved: true
```

Each alert in a group opens or updates its own incident, keyed by its fingerprint. The `severity` label sets the severity, and `summary`, `description` and `runbook_url` annotations are used when present.

## Grafana

Set the format to **Grafana**. In Grafana, go to **Alerting → Contact points**, add a contact point of type **Webhook** with the webhook URL, and use it in a notification policy. Each alert in a notification opens or updates its own incident, with links to the alert rule, dashboard, panel and silence page.

## Datadog

Set the format to **Datadog**. In Datadog, go to **Integrations → Webhooks**, add a webhook with the webhook URL and this payload:

```json
{
  "title": "$EVENT_TITLE",
  "transition": "$ALERT_TRANSITION",
  "alert_type": "$ALERT_TYPE",
  "priority": "$ALERT_PRIORITY",
  "aggregate": "$AGGREG_KEY",
  "alert_id": "$ALERT_ID",
  "body": "$EVENT_MSG",
  "link": "$LINK",
  "hostname": "$HOSTNAME",
  "tags": "$TAGS"
}
```

Then add `@webhook-<name>` to the message of each monitor that should open incidents. A recovered monitor resolves the incident. The monitor priority (P1 to P5) sets the severity.

## Sentry

Set the format to **Sentry**. In Sentry, add an internal integration (**Settings → Custom Integrations**) with the webhook URL, turn on **Alert Rule Action** and the **issue** webhook, and choose the integration as an action in your issue and metric alert rules.

- Issue alerts open an incident per Sentry issue; resolving the issue in Sentry resolves it.
- Metric alerts open an incident at warning or critical and resolve it when Sentry resolves the alert.

The legacy WebHooks plugin works too: paste the webhook URL as a callback URL.

## AWS CloudWatch

Set the format to **AWS CloudWatch (SNS)**. In Amazon SNS, add a subscription with protocol **HTTPS** and the webhook URL as the endpoint, on the topic your CloudWatch alarms notify. StatusTick confirms the subscription on its own.

Use the topic for both the **In alarm** and **OK** actions of the alarm. `ALARM` opens an incident, `OK` resolves it, and `INSUFFICIENT_DATA` is skipped.

## Answers and limits

The URL answers `204` when it takes an alert, `400` when the body is not a JSON object, and `429` when one source sends more than 120 alerts a minute. The raw body is kept for 14 days, so you can check what a tool sent.