Incident Response
Made Simple

Incidents in All Quiet can be created from any data source using our mapping engine. Here are the basics:

1. Set up a custom integration by creating an inbound integration via Webhooks .
2. Creating the integration provides you with a unique webhook endpoint. Now, an alert detected by your system can post a cURL command like this to the webhook endpoint:

   cURL example - Find your unique POST URL in your integration's details.

                   
                       curl -X POST 'https://allquiet.app/api/webhook/8fa1637f-cafa-4a5d-8bb8-af1dd5caaf2f' \
                       -H 'Content-Type: application/json' \
                       -d '{"alertName": "My Monitor", "alertStatus": "Failed", "host": "db1.acme.com"}'
                   
                   

3. All Quiet captures this HTTP request.
4. To create an incident, map the elements of the HTTP request's payload step-by-step.

For example, suppose you want to see from which environment an incident was triggered, but you only have the "host" attribute in your payload. In your example db1.acme.com would represent a production host, while app2.acme-test.com would represent a test host. So you want to identify the environment based on the host's domain. With the following mapping, you can map any host to either "Test" or "Prod" based on this very domain.

            
            {
                "name": "Environment",
                "mappings": [
                    {
                        "jsonPath": "$.jsonBody.host" // Read the host from the HTTP request's JSON body
                    },
                    {
                        "regex": "(?<=\\w+\\.)((?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,})" // Parse the domain via regex
                    },
                    {
                        "map": "acme.com->Prod,acme-test.com->Test" // Finally, map the parsed domain to the Environment
                    }
                ]
            }
            
        

After mapping the other attributes as well, the incident created in All Quiet could look like this:

Status	Severity	Team	Integration	Title	Attributes
Open	Critical	Core	webhooks	Monitoring	Alert: My Monitoring Environment: Prod