Connect Honeycomb

Firefight has a dedicated alert source for Honeycomb triggers. Honeycomb sends the token as the recipient’s shared secret, and an alert resolves in Firefight when its trigger is back to OK.

Set up the Firefight side

Go to Settings → Alert Sources, click Add source, give it a name like “Honeycomb production”, and pick the Honeycomb provider. When you create it, Firefight opens the source’s setup. It shows the ingest URL and a Copy token button for the source’s secret token, and the same steps as this page.

Set up the Honeycomb side

1. In Honeycomb, open Team Settings → Integrations and add a recipient under Trigger, SLOs, and Anomaly Detection Recipients. Choose Webhook as the provider.
2. Paste the ingest URL as the Webhook URL and the token as the Shared Secret. Leave the payload as it is and click Add.
3. Add the recipient to each trigger that should alert.

Requests that fail the check are rejected with 401, and the source’s row in Settings → Alert Sources shows the rejection.

Note

This source reads trigger notifications. SLO burn alerts and anomaly detection send a different body, which Firefight refuses as unrecognized.

What Firefight reads

Each alert gets these fields, which you can match in your routing rules.

Field	Value
title	The trigger’s name
description	The trigger’s result and its description
url	The query result in Honeycomb

The alert’s title in Slack and on the dashboard links to its page in Honeycomb.

Firing and resolving

A trigger fires an alert when Honeycomb says it is triggered, and repeat notifications count on it. When the trigger is back to OK, the alert resolves.

See Grouping & deduplication for how repeat firings collapse into one alert.