Lightstep Incident Response

The Lightstep Incident Response (LIR) Alert Method enables sending alerts through Lightstep Incident Response to notify Nobl9 users whenever an incident is triggered.

Authentication

To set up the Lightstep Incident Response (LIR) Alert Method, you must provide a webhook URL containing an API Key query parameter. You can generate this URL in the LIR UI. For detailed instructions, refer to the Generic webhook integration | LIR Documentation.

Once you’ve generated the webhook URL, you must fill in the alert mapping details. On the Field mapping tab of the Generic webhook card, you must map the state and severity alert values from your Nobl9 alerts to the corresponding alert values in LIR.

In the State field, set the following mappings:

• New = 1
• Closed = 2

In the Severity field, set the following mappings:

• Critical = High
• Major = Medium
• Minor = Low

It should look like this:

Image 1: Generic webhook card configuration

Next, manually add a new alert_policy_conditions parameter by entering its name and clicking the Add parameters button at the bottom of the page:

Image 2: Generic webhook card configuration

Once you’ve completed your configurations, click the Save button. Go back to the Integrations tab in the LIR UI, click the Copy webhook button next to the generic webhook integration you just created. Then, paste the webhook URL in the Nobl9 UI (see the instructions in the next section).

For more information, refer to the Field mapping for generic webhook integration | LIR Documentation.

Configuring the Lightstep Incident Response Alert Method

You can configure your Lightstep Incident Response Alert Method directly in the Nobl9 UI, or by applying a YAML file in sloctl.

Nobl9 UI

To set up the Alert Method in the Nobl9 UI, follow these steps:

1. Go to Integrations > Alert Methods.

2. Click the button.

3. Select Lightstep Incident Response.

4. Enter the URL (mandatory).
   Refer to the Authentication section above for more details.

5. Select a Project (mandatory).
   Specifying a project is helpful when multiple users are spread across different teams or projects. When the Project field is left blank, a default value appears.

6. Enter a Display name (optional).
   You can enter a friendly name with spaces in this field.

7. Enter a Name (mandatory).
   The name is mandatory and can only contain lowercase, alphanumeric characters and dashes (for example, my-alertmethod-name). This field is populated automatically when you enter a display name, but you can edit the result.

8. Enter a Description (optional).
   Here you can add details such as who is responsible for the integration (team/owner) and the purpose of creating it.

9. Click the Add Alert Method button.

YAML Configuration

YAML

Here’s a general specification for adding a Lightstep Incident Response Alert through YAML:

apiVersion: n9/v1alpha
kind: AlertMethod
metadata:
  name: # string # Name of the Alert Method
  displayName: # string # optional
spec:
  description: # string # optional
  lightstep:
    url: # string, secret field

The url field is kept secret and is replaced with the [hidden] string when returned from sloctl.

Example

Here's an example of Lightstep Incident Response configuration through YAML:

apiVersion: n9/v1alpha
kind: AlertMethod
metadata:
  name: lightstep-notification
  displayName: Lightstep Incident Response notification
spec:
  description: Sends HTTP request to Lightstep Incident Response
  lightstep:
    url: https://nobl9.airapp.lightstep.com/api/sn_air_core/air/5b3dee751b63c1509e40c955624bcb9e/event/generic_api?api_key=66397760dbd41d10a2e82a9d139619d3JbVRD78XRhVg

Testing the Lightstep Incident Response Alert Method

Users can test their Alert Methods for all notification services supported by the Nobl9 platform through the UI.

To verify that your Lightstep Incident Response Alert Method is set up correctly at the time that you configure it:

1. Go to Integrations > Alert Methods.

2. Follow the process outlined above to add the Alert Method in the Nobl9 UI: complete the steps in the Create Alert Method wizard, and click the Add Alert Method button.

3. On the Details screen, click the Test button in the upper-right corner. If the configuration is correct, Nobl9 will display the following message next to the button: Test completed successfully!

note

If the configuration is incorrect, Nobl9 will provide an error message with relevant details. The content of the error differs depending on the Alert Method channel.

You can also test an existing Alert Method. To do that:

1. Go to Integrations > Alert Methods.

2. Find the Alert Method you want to test in the list, and click it.

3. On the Details screen, click the Test button in the upper-right corner.

Useful Links

Generic webhook integration | LIR Documentation

Field mapping for generic webhook integration | LIR Documentation