Connect Prometheus Alertmanager

Firefight has a dedicated alert source for Prometheus Alertmanager. Alertmanager sends a group of alerts in each request, and Firefight turns each one into its own alert that resolves when Prometheus resolves it.

Set up the Firefight side

Go to Settings → Alert Sources, click Add source, give it a name like “Prometheus production”, and pick the Prometheus Alertmanager provider. When you create it, Firefight opens the source’s setup. It shows the ingest URL and a Copy token button for the source’s secret token, and the same steps as this page.

Set up the Prometheus Alertmanager side

1. In alertmanager.yml, add a receiver with a webhook_configs entry whose url is the ingest URL. Leave send_resolved on.
2. Under that entry’s http_config, add authorization with credentials set to the token. Alertmanager sends it as Authorization: Bearer.
3. Route the alerts that should reach Firefight to the receiver, then reload Alertmanager.

Requests that fail the check are rejected with 401, and the source’s row in Settings → Alert Sources shows the rejection.

receivers:
  - name: firefight
    webhook_configs:
      - url: https://<your Firefight host>/api/v1/alerts/<endpoint-path>
        send_resolved: true
        http_config:
          authorization:
            credentials: <token>

Basic auth works too. Set basic_auth with any username and the token as the password.

What Firefight reads

Each alert gets these fields, which you can match in your routing rules.

Field	Value
title	The alertname label
description	The summary and description annotations
service	The service label, else job
severity_raw	The severity label
team	The team label
environment	The environment label, else env
url	The alert’s generatorURL, the expression in Prometheus

The alert’s title in Slack and on the dashboard links to its page in Prometheus Alertmanager.

Firing and resolving

Each alert in the group is its own alert in Firefight, identified by Alertmanager’s fingerprint for its labels. A repeat notification counts on the same alert, and a resolved notification resolves it.

See Grouping & deduplication for how repeat firings collapse into one alert.