For Portail ZAPP to receive alerts from a monitoring tool, the tool is declared as a source. Each source has its own integration key: the tool sends it with every event, and Portail ZAPP rejects any payload without a valid key.
The Monitoring sources screen is reserved for the Monitoring administrators, Service Desk administrators and Administrators groups. Open it from the Alert console (Monitoring sources button).
The list of sources
For each source, the list shows its name, its status (Active or Disabled), its Max. rate/min, its Open alerts and the date of its Last event. A Key revoked badge flags a source whose key has been revoked.
Create a source
Click New source and fill in:
- Name and Description;
- Maximum rate (events per minute): above it, this source's events are rejected. The default is 120;
- Event format: how the tool writes its payloads (see below).
When you save, the Integration key is shown only once: âCopy this key now: it will never be shown again.â The Copy button puts it in the clipboard. The page also shows the address to enter in the tool and a sample payload. Click I have copied the key once the key is safely stored.
Portail ZAPP never keeps the key in clear text. If it is lost, regenerate it (see below).
Recognised formats
| Format | For which tools |
|---|---|
| Standard (PagerDuty Events v2) | Zabbix (PagerDuty media type), Datadog, Nagios, Centreon, PRTG and most tools, which can send this format. In the tool, choose the PagerDuty integration (Events API v2) and enter the address and the source key as the ârouting keyâ or âintegration keyâ |
| Prometheus Alertmanager | A webhook receiver in Alertmanager, with send_resolved so that resolution closes the alert |
| Azure Monitor (common alert schema) | A Webhook action in an Azure action group, with the common alert schema enabled |
| CloudEvents 1.0 | Custom integrations |
| Free mapping (JSON) | An older tool that only sends free JSON: you say where to find each piece of information |
Recognised formats work without configuration. The source's page shows, in the Connect the monitoring tool block, the Endpoint address for its format and the steps to follow.
Sending the key: the tool sends it in the âAuthorization: Bearerâ or âX-Routing-Keyâ header. Use the routing_key parameter in the address only if the tool cannot set a header, like the Azure Monitor webhook: an address may appear in a proxy's logs.
Free mapping
With the Free mapping (JSON) format, the page shows the Field mapping. For each piece of information, enter the path where it is read in the tool's JSON: names separated by dots, and an array index in brackets (hosts[0].name).
- Summary and Host are required;
- Deduplication key, Severity, Date, Component, Group, Class are optional. Without a deduplication key, a fingerprint of the host, component and class replaces it;
- Action field, Values that resolve and Values that acknowledge say when a payload resolves or acknowledges the alert;
- Alert array (optional): if the tool sends several alerts at once;
- Kept details (empty: everything): the information to keep in the alert's raw details;
- Severity table: one line per value of the tool, for example
Disaster=critical.
Test on an example
The Test on an example block of the page checks the connection before you rely on it: paste a real payload from the tool, then click Test. The payload is read exactly as the endpoint would, with the format and mapping entered. The result shows the Events read (action, key, summary, host, severity, component) or the Reading errors. Nothing is saved.
Disable a source, regenerate or revoke its key
On a source's page:
- untick Source enabled (events accepted) to reject its events without touching its key;
- Regenerate key creates a new key, shown only once. The old one stops working at once: remember to update the tool;
- Revoke key rejects the source's events until the next regeneration.
Next
Once the source is connected, its alerts arrive in the Alert console. To link them to CMDB CIs and open incidents automatically, see âAutomate alert processingâ.