Receive Alert Notifications via Flock

Getting started

Last9 can send alert notifications and resolutions to Flock, a team messaging platform. This document provides step-by-step instructions on how to set up Flock integration with Last9 and start receiving alert notifications.

Setting up an Incoming Webhook in Flock

1. Navigate to the Flock Developer Dashboard and sign in with your Flock account

2. Click Webhooks in the left navigation menu

3. Click Add next to Incoming Webhook

   

4. Configure your webhook:

   • Select the Channel where you want alert notifications to be posted
   • Give the webhook a descriptive Name (e.g., “Last9 Alerts”)
   • Optionally, set an Icon for the webhook messages

   

5. Click Save and Generate URL

6. Copy the generated webhook URL from the success dialog

   

7. Your webhook will now appear under Manage Webhooks

   

Setting up a notification channel in Last9

1. In Notification Channels, click Add to create a new channel

   

2. Provide the following details:

   • Channel Name: A descriptive name to easily identify the channel (e.g., “Flock Production Alerts”)
   • Channel: Select Webhook from the dropdown
   • Webhook URL: Paste the Flock webhook URL copied from the previous step
   • Send Resolved: Enable this option if you want to be notified when an alert has been resolved

   

3. Click Save to enable the channel

Assigning a notification channel to an alert group

1. Navigate to your Alert Group in Alert Studio

2. Click on the notification channel icons at the top of the alert group to configure notifications

   

3. Select your Flock channel from the Webhook dropdown under either Channels for Threat Notification or Channels for Breach Notification

   

Flock Notification Format

Last9 sends notifications to Flock using FlockML, which provides rich formatting.

Trigger Notifications

When an alert is triggered, the notification includes:

Resolved Notifications

When an alert is resolved (requires Send Resolved to be enabled), the notification includes:

Severity Indicators

Using Terraform

You can also create the Flock notification channel using the Last9 Terraform Provider:

resource "last9_notification_channel" "flock" {
  name          = "flock-production-alerts"
  type          = "webhook"
  destination   = "https://api.flock.com/hooks/sendMessage/YOUR-WEBHOOK-TOKEN"
  send_resolved = true
}

Troubleshooting

Notifications not appearing in Flock

1. Verify the webhook URL is correct and starts with https://api.flock.com/hooks/
2. Check that the webhook is still active in the Flock Developer Dashboard
3. Ensure the channel selected for the webhook still exists

Messages are not formatted correctly

Last9 auto-detects Flock webhooks based on the URL pattern. Ensure your webhook URL contains api.flock.com or flock.co.

Please get in touch with us on Discord or Email if you have any questions.