Lightstep Incident Response
The Lightstep Incident Response (LIR) Alert Method enables sending alerts through Lightstep Incident Response to notify Nobl9 users whenever an incident is triggered.
Authentication​
To set up the Lightstep Incident Response (LIR) Alert Method, you must provide a webhook URL containing an API Key query parameter. You can generate this URL in the LIR UI. For detailed instructions, refer to the Generic webhook integration | LIR Documentation.
Once you’ve generated the webhook URL, you must fill in the alert mapping details. On the Field mapping tab of the Generic webhook card, you must map the state and severity alert values from your Nobl9 alerts to the corresponding alert values in LIR.
In the State field, set the following mappings:
- New = 1
- Closed = 2
In the Severity field, set the following mappings:
- Critical = High
- Major = Medium
- Minor = Low
It should look like this:

Next, manually add a new alert_policy_conditions
parameter by entering its name and clicking the Add parameters button at the bottom of the page:

Once you’ve completed your configurations, click the Save button. Go back to the Integrations tab in the LIR UI, click the Copy webhook button next to the generic webhook integration you just created. Then, paste the webhook URL in the Nobl9 UI (see the instructions in the next section).
For more information, refer to the Field mapping for generic webhook integration | LIR Documentation.
Configuring the Lightstep Incident Response Alert Method​
You can configure your Lightstep Incident Response Alert Method directly in the Nobl9 UI, or by applying a YAML file in sloctl
.
Nobl9 UI​
To set up the Alert Method in the Nobl9 UI, follow these steps:
Go to Integrations > Alert Methods.
Click the
button.
Select Lightstep Incident Response.
Enter the URL (mandatory).
Refer to the Authentication section above for more details.Select a Project (mandatory).
Specifying a project is helpful when multiple users are spread across different teams or projects. When the Project field is left blank, a default value appears.Enter a Display name (optional).
You can enter a friendly name with spaces in this field.Enter a Name (mandatory).
The name is mandatory and can only contain lowercase, alphanumeric characters and dashes (for example,my-alertmethod-name
). This field is populated automatically when you enter a display name, but you can edit the result.Enter a Description (optional).
Here you can add details such as who is responsible for the integration (team/owner) and the purpose of creating it.Click the Add Alert Method button.
YAML Configuration​
- YAML
- Example
Here’s a general specification for adding a Lightstep Incident Response Alert through YAML:
apiVersion: n9/v1alpha
kind: AlertMethod
metadata:
name: # string # Name of the Alert Method
displayName: # string # optional
spec:
description: # string # optional
lightstep:
url: # string, secret field
The url
field is kept secret and is replaced with the [hidden]
string when returned from sloctl
.
Here's an example of Lightstep Incident Response configuration through YAML:
apiVersion: n9/v1alpha
kind: AlertMethod
metadata:
name: lightstep-notification
displayName: Lightstep Incident Response notification
spec:
description: Sends HTTP request to Lightstep Incident Response
lightstep:
url: https://nobl9.airapp.lightstep.com/api/sn_air_core/air/5b3dee751b63c1509e40c955624bcb9e/event/generic_api?api_key=66397760dbd41d10a2e82a9d139619d3JbVRD78XRhVg
Testing the Lightstep Incident Response Alert Method​
Users can test their Alert Methods for all notification services supported by the Nobl9 platform through the UI.
To verify that your Lightstep Incident Response Alert Method is set up correctly at the time that you configure it:
Go to Integrations > Alert Methods.
Follow the process outlined above to add the Alert Method in the Nobl9 UI: complete the steps in the Create Alert Method wizard, and click the Add Alert Method button.
On the Details screen, click the Test button in the upper-right corner. If the configuration is correct, Nobl9 will display the following message next to the button:
Test completed successfully!
note
If the configuration is incorrect, Nobl9 will provide an error message with relevant details. The content of the error differs depending on the Alert Method channel.
You can also test an existing Alert Method. To do that:
Go to Integrations > Alert Methods.
Find the Alert Method you want to test in the list, and click it.
On the Details screen, click the Test button in the upper-right corner.
Useful Links​
Generic webhook integration | LIR Documentation
Field mapping for generic webhook integration | LIR Documentation