Connect PostHog

Firefight has a dedicated alert source for PostHog alerts. PostHog signs each request with the source’s token, and logs alerts resolve in Firefight when they resolve in PostHog.

Set up the Firefight side

Go to Settings → Alert Sources, click Add source, give it a name like “PostHog alerts”, and pick the PostHog provider. When you create it, Firefight opens the source’s setup. It shows the ingest URL and a Copy token button for the source’s secret token, and the same steps as this page.

Set up the PostHog side

1. In PostHog, open the insight, click Monitor, then Alerts, and create an alert. Under Destinations choose Webhook, paste the ingest URL and click Add notification, then save the alert.
2. Open Data pipelines, open the webhook destination the alert created, paste the token into its Signing secret field and save.

Requests that fail the check are rejected with 401, and the source’s row in Settings → Alert Sources shows the rejection.

Firefight refuses a request without a valid signature or one signed more than five minutes ago.

What Firefight reads

Each alert gets these fields, which you can match in your routing rules.

Field	Value
title	The alert’s name
description	Which thresholds the insight broke, or how many logs matched
service	The insight’s name, or the services a logs alert watches
severity_raw	The severity levels a logs alert watches
url	The alert in PostHog

The alert’s title in Slack and on the dashboard links to its page in PostHog.

Firing and resolving

An insight alert only says when it fires, so each notification arrives as a new alert. Resolve one by hand with Resolve on the Alerts page once it is dealt with. A logs alert says when it fires and when it resolves, and Firefight resolves the alert then.

See Grouping & deduplication for how repeat firings collapse into one alert.