Skip to main content
CloudThinker currently integrates with 14 alerting and monitoring platforms including PagerDuty, Datadog, Grafana, Prometheus, AWS CloudWatch, Azure Monitor, GCP Monitoring, and more. Each integration includes platform-specific field mapping, flexible authentication, and automatic AI investigation triggers. We continue to expand platform support—if you’d like integration with a specific tool, let us know.

Supported Platforms

Incident Management

https://mintcdn.com/cloudthinker/mbO-yJISTs683mos/images/icons/integrations/pagerduty-icon.svg?fit=max&auto=format&n=mbO-yJISTs683mos&q=85&s=b92c6a39f7ed5b16ca5862fbec451830

PagerDuty

Authentication: HMAC-SHA256 (X-PagerDuty-Signature)On-call management and incident response with native event mapping for incident.triggered, incident.acknowledged, and incident.resolved events.
https://mintcdn.com/cloudthinker/mbO-yJISTs683mos/images/icons/integrations/opsgenie-icon.svg?fit=max&auto=format&n=mbO-yJISTs683mos&q=85&s=7759ebfe896418202df7d5f1ee6bebdf

Opsgenie

Authentication: API Key (Authorization: GenieKey)Atlassian’s alert management with priority mapping and team assignment data.
https://mintcdn.com/cloudthinker/mbO-yJISTs683mos/images/icons/integrations/service-now.svg?fit=max&auto=format&n=mbO-yJISTs683mos&q=85&s=41cada968c392c8a13f0745a09e8e295

ServiceNow

Authentication: Basic Auth (Authorization: Basic)Enterprise IT service management with CMDB CI mapping for infrastructure context.

Monitoring & Observability

https://mintcdn.com/cloudthinker/hw-dPQTAGvry4psc/images/icons/integrations/datadog-icon.svg?fit=max&auto=format&n=hw-dPQTAGvry4psc&q=85&s=6cb54fae84bac098b1a23312bb3f1133

Datadog

Authentication: Bearer TokenFull-stack monitoring with metrics, alerts, and tag-based service correlation.
https://mintcdn.com/cloudthinker/hw-dPQTAGvry4psc/images/icons/integrations/grafana-logo.svg?fit=max&auto=format&n=hw-dPQTAGvry4psc&q=85&s=a6f8aebeda38d594b48eb3e95106878a

Grafana

Authentication: Bearer TokenAlert notifications with dashboard links, panel context, and common labels extraction.
https://mintcdn.com/cloudthinker/mbO-yJISTs683mos/images/icons/integrations/prometheus-logo.svg?fit=max&auto=format&n=mbO-yJISTs683mos&q=85&s=7bfb37ddf1f7ef4b3ef29d84184d3692

Prometheus / Alertmanager

Authentication: Bearer TokenNative Alertmanager webhook receiver with label extraction, grouping support, and Kubernetes metadata.
https://mintcdn.com/cloudthinker/mbO-yJISTs683mos/images/icons/integrations/splunk-logo.svg?fit=max&auto=format&n=mbO-yJISTs683mos&q=85&s=63008c0a16ea4feab2d44275df3b79f3

Splunk

Authentication: Bearer TokenSaved search alerts with result context and search links.

Cloud Provider Alerting

https://mintcdn.com/cloudthinker/hw-dPQTAGvry4psc/images/icons/integrations/aws-cloudwatch.svg?fit=max&auto=format&n=hw-dPQTAGvry4psc&q=85&s=98053a00253117142c0a8ab0ca40ae97

AWS CloudWatch

Authentication: None (SNS)SNS-based alerting with alarm state, metric data, and namespace context.
https://mintcdn.com/cloudthinker/hw-dPQTAGvry4psc/images/icons/integrations/azure-monitor.svg?fit=max&auto=format&n=hw-dPQTAGvry4psc&q=85&s=92f492f655b8e9e0b57b452ee143dc5e

Azure Monitor

Authentication: NoneCommon Alert Schema support with resource context and severity mapping.
https://mintcdn.com/cloudthinker/hw-dPQTAGvry4psc/images/icons/integrations/gcp-monitoring.svg?fit=max&auto=format&n=hw-dPQTAGvry4psc&q=85&s=70e3e75ad7716a902ce0c64be0929f56

GCP Monitoring

Authentication: Bearer TokenIncident notifications with policy details and resource display names.

APM & Error Tracking

https://mintcdn.com/cloudthinker/mbO-yJISTs683mos/images/icons/integrations/new-relic.svg?fit=max&auto=format&n=mbO-yJISTs683mos&q=85&s=cd6382dad755dbafa5daa19aabc5d79f

New Relic

Authentication: API Key (Api-Key)Full-stack observability with issue priorities and entity context.
https://mintcdn.com/cloudthinker/hw-dPQTAGvry4psc/images/icons/integrations/dynatrace.svg?fit=max&auto=format&n=hw-dPQTAGvry4psc&q=85&s=e8dac9278db03795ce76bda45b3e5023

Dynatrace

Authentication: API Token (Api-Token)Software intelligence with problem impact analysis and AI-detected root causes.
https://mintcdn.com/cloudthinker/mbO-yJISTs683mos/images/icons/integrations/sentry-logo.svg?fit=max&auto=format&n=mbO-yJISTs683mos&q=85&s=1faad262a83f17ca4fb40e388d57e9f6

Sentry

Authentication: HMAC (Sentry-Hook-Signature)Application error tracking with issue details, stack traces, and project context.

Custom Integration

Generic Webhook

Authentication: Bearer Token (configurable)Fully customizable webhook for any platform. Define your own field mappings using JSONPath expressions.
Platform Roadmap: Don’t see your platform listed? We’re actively adding new integrations based on customer demand. Use the Generic Webhook for immediate integration, or contact support to request a native connector for your monitoring tool.

Setting Up a Webhook Integration

To connect your monitoring and alerting platforms to CloudThinker, follow this step-by-step setup process. The setup wizard guides you through platform selection, webhook configuration, and automatic root cause analysis settings.
Incident Response setup wizard home page with AI-powered root cause analysis overview

Incident Response dashboard with setup wizard entry point

1

Navigate to Integrations

Go to IncidentsSettingsIntegrations tab to access webhook management.
2

Create Webhook

Click Connect on your platform card. The creation wizard opens with platform-specific defaults pre-configured.
Platform selection modal showing 14 monitoring and alerting platform options including PagerDuty, Datadog, Grafana, and AWS CloudWatch

Select your monitoring platform from the available options

3

Configure Basic Info

Enter a name and optional description for your webhook. This helps you identify the integration later.
4

Review Field Mapping

Each platform has pre-configured JSONPath mappings. Customize if needed:
Incident FieldExample JSONPathDescription
Title$.event.data.titleIncident headline
Description$.event.data.descriptionDetailed information
Severity$.event.data.priorityCritical, High, Medium, Low, Info
Services$.event.data.service.nameAffected service names
Webhook configuration form showing field mapping with Title Path, Severity Path, Description Path, and Services Path JSONPath expressions

Configure JSONPath field mappings for your webhook payload

5

Configure Auto-Trigger Settings

Customize how incidents trigger root cause analysis:
  • Auto-trigger RCA: Automatically start AI investigation when incident is created
  • Minimum severity: Only trigger RCA for incidents at this severity or higher
  • Notify workspace: Send notifications to workspace members
  • Enable correlation: Group related alerts into single incidents
Root Cause Analysis configuration panel with Auto-trigger RCA toggle, Minimum Severity dropdown set to Medium, and Attach Topology View option

Configure automatic RCA triggering and severity thresholds

6

Copy Webhook URL & Authentication

The Setup tab displays your webhook URL and authentication details. Copy these credentials and configure them in your alerting platform.
Setup tab showing webhook URL, request format, HTTP headers, and code examples in cURL, JavaScript, and Python for webhook integration

Copy your webhook URL and authentication headers to configure in your alerting platform


Sending Webhooks

cURL Example

curl -X POST "https://api.cloudthinker.io/webhook/{your-webhook-token}/trigger" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{
    "title": "High CPU on production-api",
    "description": "CPU usage exceeded 90% for 5 minutes",
    "severity": "high",
    "service": "production-api"
  }'

JavaScript Example

const response = await fetch(
  'https://api.cloudthinker.io/webhook/{your-webhook-token}/trigger',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': 'Bearer YOUR_TOKEN'
    },
    body: JSON.stringify({
      title: 'High CPU on production-api',
      description: 'CPU usage exceeded 90% for 5 minutes',
      severity: 'high',
      service: 'production-api'
    })
  }
);

const result = await response.json();
console.log('Incident ID:', result.incident_id);

Python Example

import requests

response = requests.post(
    'https://api.cloudthinker.io/webhook/{your-webhook-token}/trigger',
    headers={
        'Content-Type': 'application/json',
        'Authorization': 'Bearer YOUR_TOKEN'
    },
    json={
        'title': 'High CPU on production-api',
        'description': 'CPU usage exceeded 90% for 5 minutes',
        'severity': 'high',
        'service': 'production-api'
    }
)

result = response.json()
print(f"Incident ID: {result['incident_id']}")

Authentication Methods

CloudThinker supports four authentication methods to match your platform’s requirements:

Bearer Token

Standard OAuth-style authentication. Used by Datadog, Grafana, Prometheus, Splunk, and GCP Monitoring.
Header: Authorization
Value: Bearer YOUR_WEBHOOK_TOKEN

HMAC-SHA256 Signature

Cryptographic payload verification. Used by PagerDuty and Sentry.
Header: X-PagerDuty-Signature (or platform-specific)
Value: sha256=<computed_signature>
CloudThinker validates signatures using timing-safe comparison to prevent attacks. The signature is computed as HMAC-SHA256(request_body, secret_key).

API Key Header

Custom header with optional prefix. Used by Opsgenie, New Relic, and Dynatrace.
# Opsgenie
Header: Authorization
Value: GenieKey YOUR_API_KEY

# New Relic
Header: Api-Key
Value: YOUR_API_KEY

# Dynatrace
Header: Authorization
Value: Api-Token YOUR_API_KEY

No Authentication

For platforms that verify subscriptions differently (AWS SNS, Azure Monitor).

Platform-Specific Payloads

PagerDuty

{
  "event": {
    "data": {
      "title": "Database connection timeout",
      "html_url": "https://pagerduty.com/incidents/123",
      "priority": { "summary": "high" },
      "service": { "name": "production-api" }
    }
  }
}
Field Mapping:
  • Title: $.event.data.title
  • Description: $.event.data.html_url
  • Severity: $.event.data.priority.summary
  • Services: $.event.data.service.name

Datadog

{
  "title": "High CPU on web-server-01",
  "body": "CPU usage exceeded 90% for 5 minutes",
  "alert_type": "critical",
  "tags": ["service:web-api", "env:production"]
}
Field Mapping:
  • Title: $.title
  • Description: $.body
  • Severity: $.alert_type
  • Services: $.tags

Prometheus / Alertmanager

{
  "alerts": [
    {
      "labels": {
        "alertname": "HighMemoryUsage",
        "severity": "warning",
        "service": "backend-api"
      },
      "annotations": {
        "description": "Memory usage is above 85%"
      }
    }
  ]
}
Field Mapping:
  • Title: $.alerts[0].labels.alertname
  • Description: $.alerts[0].annotations.description
  • Severity: $.alerts[0].labels.severity
  • Services: $.alerts[0].labels.service

AWS CloudWatch (via SNS)

{
  "AlarmName": "HighCPUUtilization",
  "AlarmDescription": "CPU utilization exceeded 80%",
  "NewStateValue": "ALARM",
  "Trigger": { "Namespace": "AWS/EC2" }
}
Field Mapping:
  • Title: $.AlarmName
  • Description: $.AlarmDescription
  • Severity: $.NewStateValue
  • Services: $.Trigger.Namespace

Alert Correlation

When multiple alerts arrive within a short time window, CloudThinker automatically correlates them into a single incident.

Time Window Correlation

Groups alerts received within a configurable window (default: 5 minutes). Related alerts increment the correlated_alert_count metric.

Rule-Based Correlation

Define custom rules to match alerts based on:
OperatorDescriptionExample
equalsExact matchservice equals "api"
containsSubstring matchtitle contains "timeout"
regexRegular expressiontitle regex "^DB.*Error$"
starts_withPrefix matchservice starts_with "prod-"
inArray membershipseverity in ["critical", "high"]
intersectsArray overlaptags intersects ["production"]
existsField presencemetadata.deployment_id exists

Correlation Configuration

{
  "enable_correlation": true,
  "correlation_rules": {
    "enabled": true,
    "min_match_weight": 0.5,
    "rules": [
      {
        "name": "Same Service",
        "priority": 1,
        "weight": 0.8,
        "conditions": {
          "operator": "and",
          "items": [
            { "field": "services", "operator": "intersects", "value": [] },
            { "field": "severity", "operator": "in", "value": ["critical", "high"] }
          ]
        }
      }
    ]
  }
}

Deduplication

CloudThinker prevents duplicate incidents using hash-based deduplication.
SettingDefaultDescription
Dedup KeyAuto-generatedSHA256(title + severity + connection_id)
Window24 hoursConfigurable 1-168 hours
BehaviorIncrement countDuplicates update webhook_occurrence_count

Custom Dedup Key

Extract a custom deduplication key from your payload:
{
  "field_mapping": {
    "title": "$.alert.title",
    "dedup_key": "$.alert.fingerprint"
  }
}

Security & Limits

Payload Limits

LimitValue
Max payload size100 KB
Max field length10,000 characters
Max array items100 elements
Max nesting depth10 levels

Rate Limiting

Each webhook has configurable rate limits:
  • Default: 100 requests per hour
  • Configurable: 0 (unlimited) to 10,000 requests per hour
  • Response: HTTP 429 when exceeded

Security Features

  • Timing-safe signature verification prevents timing attacks
  • HTML escaping prevents injection attacks
  • Payload sanitization truncates oversized fields
  • Sensitive header filtering removes auth/cookie headers from logs

Testing Your Integration

1

Open Test Tab

In the webhook configuration dialog, navigate to the Test tab.
2

Review Sample Payload

Each platform has a pre-configured sample payload. Copy and modify as needed.
3

Send Test

Click Send Test to verify field extraction and authentication.
4

Check Results

Success shows extracted fields. Failure shows specific error details.

Webhook Configuration Dialog

After creating a webhook, configure it through four tabs:
TabPurpose
SetupWebhook URL, authentication details, platform-specific setup guide
TestSend test payloads and verify field extraction
Field MappingConfigure JSONPath expressions for incident fields
Delivery LogsMonitor webhook delivery history and response codes

Troubleshooting

IssueSolution
Authentication failedVerify your signing secret or API key matches the source platform exactly
Fields not extractedCheck JSONPath syntax—use $.field[0] for arrays, $.field.subfield for nested objects
Duplicate incidentsAdjust deduplication window or configure explicit dedup_key extraction
Missing severityEnsure severity field maps to recognized values: critical, high, medium, low, info
Rate limit exceededIncrease rate limit in webhook settings or reduce alert volume at source
Payload too largeKeep payloads under 100KB; large fields are automatically truncated

Best Practices

  • Use HMAC authentication when available for stronger security
  • Test with sample payloads before enabling in production
  • Set appropriate severity thresholds for auto-RCA to reduce noise
  • Enable correlation to reduce alert fatigue from cascading failures
  • Monitor delivery logs to catch integration issues early
  • Use explicit dedup keys when your platform provides stable alert identifiers