Receive Alert Notifications via Zenduty

Getting started

Last9 can send alert notifications and resolutions to Zenduty, an incident management platform. This document provides step-by-step instructions on how to set up Zenduty integration with Last9 and start receiving alert notifications.

Setting up an Incoming Webhook in Zenduty

1. Log in to your Zenduty account

2. Navigate to Teams in the sidebar and select the team where you want to receive alerts

3. Click on Services in the team sidebar and select an existing service or create a new one

4. In the service page, you’ll see the Integrations tab with Incoming Integrations (Alert Sources) section

   

5. Click + Add Incoming Integration

6. Search for Generic Integration and select it

7. Configure the integration:

   • Name: Give it a descriptive name (e.g., “Last9 Alerts”)
   • Summary: Optional description
   • Create incidents for: Choose when to create incidents (e.g., “For critical alerts only”)
   • Set Default Urgency: Select the default urgency level

8. Click Add Integration

9. Copy the webhook URL provided (format: https://events.zenduty.com/integration/.../generic/.../)

   

Setting up a notification channel in Last9

1. In Notification Channels, click Add to create a new channel

2. Provide the following details:

   • Channel Name: A descriptive name to easily identify the channel (e.g., “Zenduty Production Alerts”)
   • Channel: Select Webhook from the dropdown
   • Webhook URL: Paste the Zenduty integration URL copied from the previous step
   • Send Resolved: Enable this option if you want to be notified when an alert has been resolved

3. Click Save to enable the channel

Assigning a notification channel to an alert group

1. Navigate to your Alert Group in Alert Studio

2. Click on the notification channel icons at the top of the alert group to configure notifications

3. Select your Zenduty channel from the Webhook dropdown under either Channels for Threat Notification or Channels for Breach Notification

Zenduty Notification Format

Last9 sends notifications to Zenduty using a structured payload format that Zenduty can process for incident management.

Trigger Notifications

When an alert is triggered, the notification includes:

Resolved Notifications

When an alert is resolved (requires Send Resolved to be enabled), the notification includes:

Alert Deduplication

Zenduty uses the entity_id field to correlate trigger and resolve events. This ensures that:

• Multiple triggers for the same alert are grouped together
• Resolution notifications automatically close the corresponding incident
• Alert history is maintained for post-incident analysis

Using Terraform

You can also create the Zenduty notification channel using the Last9 Terraform Provider:

resource "last9_notification_channel" "zenduty" {
  name          = "zenduty-production-alerts"
  type          = "webhook"
  destination   = "https://events.zenduty.com/integration/YOUR-ACCOUNT-ID/generic/YOUR-INTEGRATION-KEY/"
  send_resolved = true
}

Troubleshooting

Notifications not appearing in Zenduty

1. Verify the webhook URL is correct and starts with https://events.zenduty.com/integration/
2. Check that the integration is enabled (toggle should be ON) in Zenduty
3. Ensure the service associated with the integration is not in maintenance mode
4. Verify the team and service are active in Zenduty

Incidents not auto-resolving

1. Verify Send Resolved is enabled in the Last9 notification channel settings
2. Check that the same integration URL is used for both trigger and resolve notifications
3. Ensure Zenduty’s auto-resolution settings are configured for the service

Alert details missing

Last9 sends comprehensive alert details in the payload. If you’re not seeing expected fields:

1. Check your Zenduty integration rules and transformations
2. Verify the alert rule in Last9 has a description configured

Please get in touch with us on Discord or Email if you have any questions.