Notification Channels

Notification Channels are destinations for Last9 to send alert notifications. We currently support Slack, PagerDuty, Opsgenie, Webhook, and Email integrations.

Adding a Notification Channel#Copy link

1. Navigate to Notification Channels and click Add

2. Provide the following details:

   

   • Channel Name: Descriptive name to easily identify channel destination
   • Channel: Choose a channel from the supported integrations list
   • Webhook/API Key/Email: Provide the relevant details for the selected channel
     • Slack: See how to send messages using Incoming Webhooks
     • PagerDuty: See how to use the PagerDuty Events V2 API
     • Email: Enter the email IDs to be notified
     • Opsgenie: Enter the API key
     • Webhook: Enter the webhook to be triggered, and headers (like auth), if any
   • Send Resolved: Enable if you want to be notified when an alert has been resolved, useful for automation of incident management

3. If you’ve selected Slack as the channel, you can also send a test message to the configured channel by clicking on Test Config

   

4. Click on Save to enable this channel. This channel can now be used in Alert Groups or Scheduled Search to start receiving notification

Usage of a Notification Channel#Copy link

In Notification Channels, you can quickly understand which configured channels are being used and by how many alert groups or scheduled searches.

To view which alert groups or scheduled searches are using a particular channel, click on the relevant channel’s Usage link to view the list. From here, you can also jump to any of the alert groups or scheduled searches.

Notification Payloads#Copy link

In case you want to further use the generated JSON payloads for custom incident details, automation and workflows, alert enrichment, or integrating with other tools, refer to the following mapping for PagerDuty and Opsgenie.

PagerDuty#Copy link

Custom Details

• alert_condition - Condition set on alert. Static alerts, it is of the format.expr > 10 based on the threshold configured. For pattern-based alerts, it is of the format algo_type(tunable, expr). For example, for a high spike alert set with tunable 3, this would be high_spike(3, expr)
• algo_type - Type of alert (static_threshold, increasing_changepoint etc)
• client_url - Link to the health dashboard for this alert on Last9
• description - Description of the alert. If a description is provided while configuring the rule, it appears here. Otherwise, a default description based on the algorithm, indicator, and entity is shown
• start - Starting time of this alert, in ISO 8601 format
• end- Ending time of this alert, in ISO 8601 format
• expression - Name of the indicator
• entity_name - Entity name
• entity_type - Entity type
• entity_team - Entity team. Is None if not assigned
• entity_tier - Entity tier. Is None if not assigned
• entity_workspace - Entity workspace. Is None if not assigned
• entity_namespace - Entity namespace. Is None if not assigned
• severity - Severity of the alert (breach/ threat)
• notification_call - Whether this alert is sent for the first time or repeated (first/ repeat)
• runbook - Link to the runbook for this alert (has to be configured while setting up alert). This key is omitted if the runbook isn’t configured
• If the entity under alert has tags associated with it, they are included in custom details as tag_<tag_name> = true
• time_in_alert - Duration for which this alert was observed. E.g., 8 in 10 minutes.

Opsgenie#Copy link

Details

• alert_condition: Condition set on alert. Static alerts, it is of the format.expr > 10 based on the threshold configured. For anomaly alerts, it is of the format algo_name(tunable, expr). For example, for a high spike alert set with tunable 3, this would be high_spike(3, expr)
• algorithm: Type of alert (static_threshold, increasing_changepoint etc)
• component: null
• last9_dashboard: Link to the health dashboard for this alert
• expression: Name of the indicator
• service: Name and type of the entity
• source: Dedup key for this incident
• entity_name: Entity name
• entity_type: Entity type
• entity_team: Entity team. Is None if not assigned
• entity_tier: Entity tier. Is None if not assigned
• entity_workspace: Entity workspace. Is None if not assigned
• entity_namespace: Entity namespace. Is None if not assigned
• severity: Severity of the alert (breach/ threat)
• notification_call: Whether this alert is sent for the first time or repeated (first/ repeat)
• runbook: Link to the runbook for this alert (has to be configured while setting up alert). This key is omitted if the runbook isn’t configured

Webhook#Copy link

Sample Payloads

{
  "payload": {
    "summary": "Scheduled Search Triggered - Dashboard logs",
    "timestamp": "2025-04-07T04:32:00.000+0000",
    "severity": "critical",
    "component": null,
    "source": "3eee4fb7:241fb9df-8d31-4f69-8122-38d16bbe16df:breach-static_threshold",
    "group": "3eee4fb7:241fb9df-8d31-4f69-8122-38d16bbe16df:breach-static_threshold",
    "class": "Static Threshold",
    "custom_details": {
      "description": "Scheduled Search Alert is Triggered. Please check the Last9 Dashboard for more details.",
      "severity": "Breach",
      "client_url": "https://app.last9.io/logs?logql=%7Bservice%3D%22dashboard%22%7D&from=1743999960&to=1744000320",
      "rule_name": "Dashboard logs",
      "telemetry": "logs",
      "query": "{service=\"dashboard\"}",
      "evaluation_frequency": "Every 5 Minutes",
      "alert_condition": "expr > 7",
      "metric_name": "last9_change_events"
    }
  },
  "routing_key": "https://app.last9.io/api/v4/generic_webhook?email=apps@last9.io",
  "dedup_key": "3eee4fb7:241fb9df-8d31-4f69-8122-38d16bbe16df:breach-static_threshold",
  "images": [],
  "links": [],
  "event_action": "trigger",
  "client": "Last9 Dashboard",
  "client_url": "https://app.last9.io/logs?logql=%7Bservice%3D%22dashboard%22%7D&from=1743999960&to=1744000320"
}

{
  "routing_key": "https://alpha.last9.io/api/v4/generic_webhook?email=apps@last9.io",
  "dedup_key": "3eee4fb7:241fb9df-8d31-4f69-8122-38d16bbe16df:breach-static_threshold",
  "event_action": "resolve"
}

Troubleshooting#Copy link

Please get in touch with us on Discord or Email if you have any questions.