Receive Alert Notifications via Opsgenie

Getting started

Last9 can send alert notifications and resolutions to Opsgenie using an Opsgenie API key. This page covers setting up the channel and the JSON payload Last9 sends.

Setting up a notification channel in Last9

1. In Notification Channels, click Add Channel and choose Opsgenie.
2. Enter the Opsgenie API key in the API key field.
3. Save the channel. Assign it to an Alert Group to start receiving notifications.

Notification Payload

Use these JSON fields for custom incident details, automation, alert enrichment, or integrating with other tools.

Opsgenie field	Type	Description
message	string	Title for the incident
alias	string	Dedup key for the incident
description	string	Description of the alert. If a description is provided while configuring the rule, it appears here. Otherwise, this field is omitted
tags	array of strings	Tags associated with the entity
actions	array of strings	[“Debug”]
details	object	Described below
entity	string	null
source	string	Last9 Dashboard
note	string	A string description of the alert, along with the health dashboard link for the alert
responders	array of objects	Not used
visibleTo	array of objects	Not used
priority	string	Not used
user	string	Not used

Details

• alert_condition: Condition set on alert. Static alerts, it is of the format.expr > 10 based on the threshold configured. For anomaly alerts, it is of the format algo_name(tunable, expr). For example, for a high spike alert set with tunable 3, this would be high_spike(3, expr)
• algorithm: Type of alert (static_threshold, increasing_changepoint etc)
• component: null
• last9_dashboard: Link to the health dashboard for this alert
• expression: Name of the indicator
• service: Name and type of the entity
• source: Dedup key for this incident
• entity_name: Entity name
• entity_type: Entity type
• entity_team: Entity team. Is None if not assigned
• entity_tier: Entity tier. Is None if not assigned
• entity_workspace: Entity workspace. Is None if not assigned
• entity_namespace: Entity namespace. Is None if not assigned
• severity: Severity of the alert (breach/ threat)
• notification_call: Whether this alert is sent for the first time or repeated (first/ repeat)
• runbook: Link to the runbook for this alert (has to be configured while setting up alert). This key is omitted if the runbook isn’t configured

---

Troubleshooting

Please get in touch with us on Discord or Email if you have any questions.