Connect Northflank

Firefight has a dedicated alert source for Northflank’s webhook notification integrations. Northflank events such as container crashes arrive pre-normalized, so there is no field mapping to configure.

Set up the Firefight side

Go to Settings → Alert Sources, click Add source, give it a name like “Northflank production”, and pick the Northflank provider. Firefight generates an ingest URL and a secret token. Copy both from the sources table.

Set up the Northflank side

In Northflank, create a webhook notification integration.

1. Set the webhook URL to the ingest URL you copied.
2. Paste the token into the integration’s token field. Northflank sends it on every request in the X-Northflank-Notification-Integration-Token header, which is how Firefight authenticates the source.
3. Choose which events the integration should send and which projects it covers.

Requests with a missing or wrong token are rejected with 401.

What Firefight extracts

From each Northflank event, Firefight builds an alert with these fields:

Field	Value
event	The Northflank event type, such as container:crash
title	A readable summary like Container crash: api-server (my-project), built from the event, the affected service, job, or addon, and the project
service	The Northflank service id, when the event concerns a service
environment	The Northflank environment id, when present

You can match on any of these in your routing rules. The event field is the most useful condition, for example event starts with container:.

Behavior to know

Northflank events are one-shot notifications with no resolved counterpart, so Northflank alerts are always in the firing state. They never auto-resolve the way a Prometheus or Grafana alert does.

A crash-looping container does not flood you. Firefight fingerprints Northflank alerts on the event type, project, and service, so repeated crashes of the same container update one alert and increment its fire count instead of creating new alerts. See Grouping & deduplication.

Northflank events carry no severity. When a rule creates an incident from a Northflank alert, set the severity on the rule’s outcome, otherwise the workspace default severity applies.

Tip

Give the source’s routing its own rules via Settings → Alert Sources → Routing on the source row. A common setup creates an incident for event is one of container:crash and drops or notifies on everything else. Dry-run it first with Testing your routing.