# Receive Alert Notifications via Zenduty

> Setup Zenduty integration and receive alert notifications from Last9.

Source: https://last9.io/docs/zenduty-integration/

## Getting started

Last9 can send alert notifications and resolutions to Zenduty, an incident management platform. This document provides step-by-step instructions on how to set up Zenduty integration with Last9 and start receiving alert notifications.

:::tip
Last9 automatically detects Zenduty webhook URLs and formats notifications with rich context including severity, alert details, and direct links to Last9 dashboards.
:::

## Setting up an Incoming Webhook in Zenduty

1. Log in to your [Zenduty](https://www.zenduty.com/) account

2. Navigate to **Teams** in the sidebar and select the team where you want to receive alerts

3. Click on **Services** in the team sidebar and select an existing service or create a new one

4. In the service page, you'll see the **Integrations** tab with **Incoming Integrations (Alert Sources)** section

   ![Zenduty Service Integrations](../../../../../assets/content/docs/alerting/guides/zenduty-integration/zenduty-service-integrations.png)

5. Click **+ Add Incoming Integration**

6. Search for **Generic Integration** and select it

7. Configure the integration:

   - **Name**: Give it a descriptive name (e.g., "Last9 Alerts")
   - **Summary**: Optional description
   - **Create incidents for**: Choose when to create incidents (e.g., "For critical alerts only")
   - **Set Default Urgency**: Select the default urgency level

8. Click **Add Integration**

9. Copy the webhook URL provided (format: `https://events.zenduty.com/integration/.../generic/.../`)

   ![Zenduty Webhook URL](../../../../../assets/content/docs/alerting/guides/zenduty-integration/zenduty-webhook-url.png)

:::note
Keep this webhook URL secure. Anyone with access to this URL can send alerts to your Zenduty service.
:::

## Setting up a notification channel in Last9

1. In [Notification Channels](https://app.last9.io/alerting/notification-channels/), click **Add** to create a new channel

2. Provide the following details:

   - **Channel Name**: A descriptive name to easily identify the channel (e.g., "Zenduty Production Alerts")
   - **Channel**: Select **Webhook** from the dropdown
   - **Webhook URL**: Paste the Zenduty integration URL copied from the previous step
   - **Send Resolved**: Enable this option if you want to be notified when an alert has been resolved

3. Click **Save** to enable the channel

:::tip
Last9 automatically detects Zenduty webhook URLs (containing `zenduty.com`) and formats the notifications appropriately for Zenduty.
:::

## Assigning a notification channel to an alert group

1. Navigate to your Alert Group in [Alerting](https://app.last9.io/alerting/)

2. Click on the notification channel icons at the top of the alert group to configure notifications

3. Select your Zenduty channel from the **Webhook** dropdown under either **Channels for Threat Notification** or **Channels for Breach Notification**

:::tip
You can set different notification channels for `threat` and `breach` notifications depending on the severity of the alerts.
:::

## Zenduty Notification Format

Last9 sends notifications to Zenduty using a structured payload format that Zenduty can process for incident management.

### Trigger Notifications

When an alert is triggered, the notification includes:

| Field      | Description                                           |
| ---------- | ----------------------------------------------------- |
| title      | Alert summary (e.g., "High error rate on api-server") |
| alert_type | Severity level from Last9 (critical, warning, etc.)   |
| message    | Alert summary text                                    |
| summary    | Detailed description of the alert condition           |
| payload    | Full alert payload with all context                   |
| urls       | Link to "View in Last9 Dashboard"                     |
| entity_id  | Deduplication key for correlating alerts              |

### Resolved Notifications

When an alert is resolved (requires **Send Resolved** to be enabled), the notification includes:

| Field      | Description                            |
| ---------- | -------------------------------------- |
| title      | "Resolved: {original summary}"         |
| alert_type | "resolved"                             |
| message    | "Alert has been resolved: {summary}"   |
| summary    | Original alert description             |
| urls       | Link to "View in Last9 Dashboard"      |
| entity_id  | Same deduplication key for correlation |

### Alert Deduplication

Zenduty uses the `entity_id` field to correlate trigger and resolve events. This ensures that:

- Multiple triggers for the same alert are grouped together
- Resolution notifications automatically close the corresponding incident
- Alert history is maintained for post-incident analysis

---

## Using Terraform

You can also create the Zenduty notification channel using the [Last9 Terraform Provider](/docs/terraform-provider/):

```hcl
resource "last9_notification_channel" "zenduty" {
  name          = "zenduty-production-alerts"
  type          = "webhook"
  destination   = "https://events.zenduty.com/integration/YOUR-ACCOUNT-ID/generic/YOUR-INTEGRATION-KEY/"
  send_resolved = true
}
```

---

## Troubleshooting

### Notifications not appearing in Zenduty

1. Verify the webhook URL is correct and starts with `https://events.zenduty.com/integration/`
2. Check that the integration is enabled (toggle should be ON) in Zenduty
3. Ensure the service associated with the integration is not in maintenance mode
4. Verify the team and service are active in Zenduty

### Incidents not auto-resolving

1. Verify **Send Resolved** is enabled in the Last9 notification channel settings
2. Check that the same integration URL is used for both trigger and resolve notifications
3. Ensure Zenduty's auto-resolution settings are configured for the service

### Alert details missing

Last9 sends comprehensive alert details in the payload. If you're not seeing expected fields:

1. Check your Zenduty integration rules and transformations
2. Verify the alert rule in Last9 has a description configured

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.