Alerts, routed into incidents

Point your monitoring at Firefight and the alerts that matter become incidents, while the noise stays out of your channels. You decide what matters with routing rules, and Firefight handles the repeats, the flapping, and the storms.

Sources. Create an alert source under Settings → Alert Sources and point your tool at its URL. The generic webhook works with Datadog, Grafana, Prometheus Alertmanager, or anything that can POST JSON, with a configurable mapping from the payload to normalized fields like title, service, and severity. Northflank has a dedicated integration.

Routing rules. Rules run in order and the first match wins. Each pairs conditions on the alert's fields with one of four outcomes: create an incident, attach to an open incident, notify a channel or person without an incident, or drop. Alerts that match nothing are stored as unmatched and stay visible, so you can see what fell through and tighten your rules.

The catalogue fills in the blanks. An alert carrying only service: checkout is enriched before routing. The owning team is merged in from the catalogue, and entry attributes become fields like service.tier, so a rule can route by metadata the alert itself never sent.

Built for noisy nights. Repeat firings update the existing alert instead of creating new ones, a flap window catches alerts that resolve and immediately re-fire, and a grouping window attaches related alerts to the incident already open for the problem. One bad deploy that fires fifty alerts becomes one incident with fifty attached alerts, and one Slack digest message that updates in place.

Dry runs. Test a hypothetical alert against your real rules from Settings → Alert Routing before pointing production at it, and see the per-condition trace of what matched. Connected agents get the same thing through evaluate_routing, which never creates or notifies.