Connect Datadog

Firefight has a dedicated alert source for Datadog monitors. Datadog lets you write the webhook’s body yourself, so the source’s setup gives you a payload template to paste, and every alert recovers in Firefight when the monitor recovers.

Set up the Firefight side

Go to Settings → Alert Sources, click Add source, give it a name like “Datadog monitors”, and pick the Datadog provider. When you create it, Firefight opens the source’s setup. It shows the ingest URL and a Copy token button for the source’s secret token, and the same steps as this page.

Set up the Datadog side

1. In Datadog, open the Webhooks integration and add a webhook. Name it, for example firefight, and paste the ingest URL as its URL.
2. Replace its payload with the template from the source’s setup (click Copy template). Leave Encode as form off.
3. Under Custom Headers, enter {"X-Firefight-Token": "<token>"} with the source’s token, and save.
4. Mention @webhook-firefight, or the name you chose, in the message of each monitor that should alert.

Requests that fail the check are rejected with 401, and the source’s row in Settings → Alert Sources shows the rejection.

Caution

Datadog’s default webhook body says nothing about whether a monitor triggered or recovered. Firefight refuses it as an unrecognized payload, so the template is required.

What Firefight reads

Each alert gets these fields, which you can match in your routing rules.

Field	Value
title	The monitor’s event title, without the leading [Triggered on ...]
description	The monitor’s message
service	The monitor’s service tag
environment	The monitor’s env tag
team	The monitor’s team tag
severity_raw	The monitor’s priority, such as P1
url	The event in Datadog

The alert’s title in Slack and on the dashboard links to its page in Datadog.

Firing and resolving

Every transition except Recovered fires, including warnings, no data and renotifications, and each counts on the same alert until the monitor recovers. The recovery resolves it.

See Grouping & deduplication for how repeat firings collapse into one alert.