> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Alert Sources

> Find the right path for getting your alerts into Resolve, whether your tool has a preset, needs a custom source, or is polled for you.

[Resolve](https://docs.cloudthinker.io/guide/incident/overview.md) investigates the alerts you send it, and every source arrives one of three ways: a webhook, an AWS polling source, or a chat channel. This page finds your path and sends you to the one page that sets it up.

## How an alert reaches Resolve

1. Your source delivers the alert: a webhook call, a polled AWS service, or a message in a chat channel Resolve watches.
2. [Pulse](https://docs.cloudthinker.io/guide/pulse/overview.md) drops duplicates and noise. What survives is a **signal**.
3. Pulse groups related signals into a **cluster**: one problem, however many alerts it produced.
4. A cluster that holds an actionable signal is filed as an incident — matched to an open one, or opened as a new one. While **On duty**, CloudThinker investigates it on its own.

Whichever path you take, you set it up in one place: **Resolve → Integrations**. Every path needs the workspace **Admin** role and admin access to the tool that produces the alerts. See [Roles](https://docs.cloudthinker.io/guide/security/roles.md).

![Resolve Integrations page with platforms grouped by readiness and a search field](https://mintcdn.com/cloudthinker/7N5Axt6gSxkmeWiW/images/v2/resolve-integrations.webp?fit=max\&auto=format\&n=7N5Axt6gSxkmeWiW\&q=85\&s=0d3985f064960e0c8b5474323648bfed)

Resolve Integrations: platforms grouped by readiness, Needs attention first

Delivery and investigation are separate settings. While **On duty** shows **Paused**, your sources keep delivering and an actionable cluster is still filed as an incident with status **Open**: what waits is automatic triage and investigation, until someone clicks **Investigate**. See [What starts an investigation](https://docs.cloudthinker.io/guide/incident/settings.md#what-starts-an-investigation).

## Choose your path

| What you have | Which path to take | The page that does it |
| - | - | - |
| A monitoring or alerting tool CloudThinker lists, such as Datadog, Grafana, or PagerDuty | Add a webhook signal. The field mapping and severity mapping arrive filled in for that tool. | [Webhook signals](https://docs.cloudthinker.io/guide/incident/webhook-integrations/overview.md) |
| A tool or in-house system CloudThinker doesn't list, such as an uptime checker or a cron job | Create a custom source, send it one real event, then click the fields in that event to map them. | [Add a custom signal source](https://docs.cloudthinker.io/guide/incident/webhook-integrations/custom-source.md) |
| AWS CloudWatch alarms | Create the AWS CloudWatch webhook, then forward alarm state changes to it with Amazon EventBridge. No code to maintain. | [Connect CloudWatch alarms](https://docs.cloudthinker.io/guide/incident/webhook-integrations/cloudwatch.md) |
| AWS services CloudThinker reads for you: CloudTrail, AWS Health, AWS GuardDuty, AWS IAM Access Analyzer, and AWS Config | Turn on a polling source: CloudThinker reads the service on a schedule instead of waiting for a webhook. Nothing to paste into AWS, but you need an [AWS connection](https://docs.cloudthinker.io/guide/connections/aws.md). | [Connect Pulse sources](https://docs.cloudthinker.io/guide/pulse/setup.md#connect-a-source) |
| A Slack or Microsoft Teams channel where people report problems | Add the channel under **Listen for incidents**. Messages people post become signals; in Slack, messages from bots are skipped. | [Connect Pulse sources](https://docs.cloudthinker.io/guide/pulse/setup.md#connect-a-source) |
| A deploy script or app that should start an agent run rather than an incident | Create an Automation webhook trigger instead. It runs an [Automation](https://docs.cloudthinker.io/guide/automation/automations.md) and opens no incident. | [Inbound webhooks](https://docs.cloudthinker.io/guide/webhooks/overview.md) |
| Something already connected, and you're not sure it's working | Read the platform's readiness badge, then confirm one signal in Pulse. | [Resolve Integrations](https://docs.cloudthinker.io/guide/incident/integrations.md#read-readiness) |

> [!TIP]
>
> A successful response from a webhook only proves delivery. Confirm one signal on **Resolve → Pulse** before you rely on any source.

## Tools with a preset

A **preset** is the field mapping and severity mapping Resolve fills in when you pick a tool, so you don't have to work out which part of the payload holds the title or the severity. These tools have one:

| Kind of tool | Tools with a preset |
| - | - |
| Monitoring | Datadog, Grafana, Prometheus, Splunk, Zabbix, Elastic (ELK), Nagios, SolarWinds, PRTG, LogicMonitor, Sumo Logic, Pingdom |
| Cloud Monitoring | AWS CloudWatch, Azure Monitor, GCP Monitoring |
| APM (application performance monitoring) | New Relic, Dynatrace, AppDynamics |
| Error Tracking | Sentry |
| AIOps | BigPanda |
| Incident Management | PagerDuty, Opsgenie, ServiceNow, Jira Service Management, incident.io, Splunk On-Call |

A preset also picks the authentication the tool supports: PagerDuty signs its webhooks, and CloudWatch sends a named key header.

A filled-in mapping isn't a verified one. Check it against a real payload before you trust it, because a preset can point at a field your tool doesn't send: the Datadog preset's service path is one example. See [Map the fields](https://docs.cloudthinker.io/guide/incident/webhook-integrations/overview.md#map-the-fields).

Anything not in this table goes through a custom source, where you map the fields by clicking them in a payload your system really sent.

## Next steps

> **[Set up a webhook signal](https://docs.cloudthinker.io/guide/incident/webhook-integrations/overview.md)**
>
> Map a listed tool's alerts into Pulse and choose when CloudThinker investigates.

> **[Connect Pulse sources](https://docs.cloudthinker.io/guide/pulse/setup.md)**
>
> Add a webhook, an AWS polling source, or a chat channel, then confirm it delivers.

> **[Add a custom signal source](https://docs.cloudthinker.io/guide/incident/webhook-integrations/custom-source.md)**
>
> Connect a system with no preset by clicking the fields in its own payload.

> **[Check what's connected](https://docs.cloudthinker.io/guide/incident/integrations.md)**
>
> Read each platform's connection, signals, and readiness badge.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.