Skip to main content
CloudThinker currently integrates with 15 alerting and monitoring platforms including PagerDuty, Datadog, Grafana, Prometheus, AWS CloudWatch, Azure Monitor, GCP Monitoring, and more. Each integration includes platform-specific field mapping, flexible authentication, and automatic AI investigation triggers. We continue to expand platform support—if you’d like integration with a specific tool, let us know.

Supported Platforms

Incident Management

https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/pagerduty-icon.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=7e1bb7c9ae2e6aa13608c8d4d48811cf

PagerDuty

Authentication: HMAC-SHA256 (X-PagerDuty-Signature)On-call management and incident response with native event mapping for incident.triggered, incident.acknowledged, and incident.resolved events.
https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/opsgenie-icon.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=3d1eba78a1a7252aee45c08b7538d020

Opsgenie

Authentication: API Key (Authorization: GenieKey)Atlassian’s alert management with priority mapping and team assignment data.
https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/service-now.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=0732f3ddc9a9af6f7c3325a74c7aa30a

ServiceNow

Authentication: Basic Auth (Authorization: Basic)Enterprise IT service management with CMDB CI mapping for infrastructure context.

Monitoring & Observability

https://mintcdn.com/cloudthinker/ezLyBgfIZEMSknyR/images/icons/integrations/datadog-icon.svg?fit=max&auto=format&n=ezLyBgfIZEMSknyR&q=85&s=3548a1b2e3bc616d2d37d439eba151c6

Datadog

Authentication: Bearer TokenFull-stack monitoring with metrics, alerts, and tag-based service correlation.
https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/grafana-logo.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=e0a907966b1ad4ff181ef93cb411e373

Grafana

Authentication: Bearer TokenAlert notifications with dashboard links, panel context, and common labels extraction.
https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/prometheus-logo.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=116d0e24c961b3e19e141d98a61ae3b8

Prometheus / Alertmanager

Authentication: Bearer TokenNative Alertmanager webhook receiver with label extraction, grouping support, and Kubernetes metadata.
https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/splunk-logo.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=51fa124f58603c02e7cb344825795746

Splunk

Authentication: Bearer TokenSaved search alerts with result context and search links.

Cloud Provider Alerting

https://mintcdn.com/cloudthinker/ezLyBgfIZEMSknyR/images/icons/integrations/aws-cloudwatch.svg?fit=max&auto=format&n=ezLyBgfIZEMSknyR&q=85&s=9539b73889491ac68c768dc601c6276d

AWS CloudWatch

Authentication: None (SNS)SNS-based alerting with alarm state, metric data, and namespace context.
https://mintcdn.com/cloudthinker/ezLyBgfIZEMSknyR/images/icons/integrations/azure-monitor.svg?fit=max&auto=format&n=ezLyBgfIZEMSknyR&q=85&s=b0b37194fd8282e599655adc7b172104

Azure Monitor

Authentication: NoneCommon Alert Schema support with resource context and severity mapping.
https://mintcdn.com/cloudthinker/ezLyBgfIZEMSknyR/images/icons/integrations/gcp-monitoring.svg?fit=max&auto=format&n=ezLyBgfIZEMSknyR&q=85&s=d1316eb20b417d6afd7814699236ebcf

GCP Monitoring

Authentication: Bearer TokenIncident notifications with policy details and resource display names.

APM & Error Tracking

https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/new-relic.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=f302e6dc3976df413a0ebe8fa92da32d

New Relic

Authentication: API Key (Api-Key)Full-stack observability with issue priorities and entity context.
https://mintcdn.com/cloudthinker/ezLyBgfIZEMSknyR/images/icons/integrations/dynatrace.svg?fit=max&auto=format&n=ezLyBgfIZEMSknyR&q=85&s=d1c94ab707135fdc0bd47de611b56760

Dynatrace

Authentication: API Token (Api-Token)Software intelligence with problem impact analysis and AI-detected root causes.
https://mintcdn.com/cloudthinker/NZTEnySYVy068g6u/images/icons/integrations/sentry-logo.svg?fit=max&auto=format&n=NZTEnySYVy068g6u&q=85&s=b7af115d7baa85cf43f93e80cb319cd4

Sentry

Authentication: HMAC (Sentry-Hook-Signature)Application error tracking with issue details, stack traces, and project context.

Custom Integration

Generic Webhook

Authentication: Bearer Token (configurable)Fully customizable webhook for any platform. Define your own field mappings using JSONPath expressions.
Platform Roadmap: Don’t see your platform listed? We’re actively adding new integrations based on customer demand. Use the Generic Webhook for immediate integration, or contact support to request a native connector for your monitoring tool.

Setting Up a Webhook Integration

To connect your monitoring and alerting platforms to CloudThinker, follow this step-by-step setup process. The setup wizard guides you through platform selection, webhook configuration, and automatic root cause analysis settings.
Incident Response setup wizard home page with AI-powered root cause analysis overview

Incident Response dashboard with setup wizard entry point

1

Navigate to Integrations

Go to IncidentsSettingsIntegrations tab to access webhook management.
2

Create Webhook

Click Connect on your platform card. The creation wizard opens with platform-specific defaults pre-configured.
Platform selection modal showing 15 monitoring and alerting platform options including PagerDuty, Datadog, Grafana, and AWS CloudWatch

Select your monitoring platform from the available options

3

Configure Basic Info

Enter a name and optional description for your webhook. This helps you identify the integration later.
4

Review Field Mapping

Each platform has pre-configured JSONPath mappings. Customize if needed:
Incident FieldExample JSONPathDescription
Title$.event.data.titleIncident headline
Description$.event.data.descriptionDetailed information
Severity$.event.data.priorityCritical, High, Medium, Low, Info
Services$.event.data.service.nameAffected service names
Webhook configuration form showing field mapping with Title Path, Severity Path, Description Path, and Services Path JSONPath expressions

Configure JSONPath field mappings for your webhook payload

5

Configure Auto-Trigger Settings

Customize how incidents trigger root cause analysis:
  • Auto-trigger RCA: Automatically start AI investigation when incident is created
  • Minimum severity: Only trigger RCA for incidents at this severity or higher
  • Notify workspace: Send notifications to workspace members
  • Enable correlation: Group related alerts into single incidents
Root Cause Analysis configuration panel with Auto-trigger RCA toggle, Minimum Severity dropdown set to Medium, and Attach Topology View option

Configure automatic RCA triggering and severity thresholds

6

Copy Webhook URL & Authentication

The Setup tab displays your webhook URL and authentication details. Copy these credentials and configure them in your alerting platform.
Setup tab showing webhook URL, request format, HTTP headers, and code examples in cURL, JavaScript, and Python for webhook integration

Copy your webhook URL and authentication headers to configure in your alerting platform


Sending Webhooks

cURL Example

curl -X POST "https://api.cloudthinker.io/webhook/{your-webhook-token}/trigger" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{
    "title": "High CPU on production-api",
    "description": "CPU usage exceeded 90% for 5 minutes",
    "severity": "high",
    "service": "production-api"
  }'

JavaScript Example

const response = await fetch(
  'https://api.cloudthinker.io/webhook/{your-webhook-token}/trigger',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': 'Bearer YOUR_TOKEN'
    },
    body: JSON.stringify({
      title: 'High CPU on production-api',
      description: 'CPU usage exceeded 90% for 5 minutes',
      severity: 'high',
      service: 'production-api'
    })
  }
);

const result = await response.json();
console.log('Incident ID:', result.incident_id);

Python Example

import requests

response = requests.post(
    'https://api.cloudthinker.io/webhook/{your-webhook-token}/trigger',
    headers={
        'Content-Type': 'application/json',
        'Authorization': 'Bearer YOUR_TOKEN'
    },
    json={
        'title': 'High CPU on production-api',
        'description': 'CPU usage exceeded 90% for 5 minutes',
        'severity': 'high',
        'service': 'production-api'
    }
)

result = response.json()
print(f"Incident ID: {result['incident_id']}")

Authentication Methods

CloudThinker supports four authentication methods to match your platform’s requirements:

Bearer Token

Standard OAuth-style authentication. Used by Datadog, Grafana, Prometheus, Splunk, and GCP Monitoring.
Header: Authorization
Value: Bearer YOUR_WEBHOOK_TOKEN

HMAC-SHA256 Signature

Cryptographic payload verification. Used by PagerDuty and Sentry.
Header: X-PagerDuty-Signature (or platform-specific)
Value: sha256=<computed_signature>
CloudThinker validates signatures using timing-safe comparison to prevent attacks. The signature is computed as HMAC-SHA256(request_body, secret_key).

API Key Header

Custom header with optional prefix. Used by Opsgenie, New Relic, and Dynatrace.
# Opsgenie
Header: Authorization
Value: GenieKey YOUR_API_KEY

# New Relic
Header: Api-Key
Value: YOUR_API_KEY

# Dynatrace
Header: Authorization
Value: Api-Token YOUR_API_KEY

No Authentication

For platforms that verify subscriptions differently (AWS SNS, Azure Monitor).

Platform-Specific Payloads

PagerDuty

{
  "event": {
    "data": {
      "title": "Database connection timeout",
      "html_url": "https://pagerduty.com/incidents/123",
      "priority": { "summary": "high" },
      "service": { "name": "production-api" }
    }
  }
}
Field Mapping:
  • Title: $.event.data.title
  • Description: $.event.data.html_url
  • Severity: $.event.data.priority.summary
  • Services: $.event.data.service.name

Datadog

{
  "title": "High CPU on web-server-01",
  "body": "CPU usage exceeded 90% for 5 minutes",
  "alert_type": "critical",
  "tags": ["service:web-api", "env:production"]
}
Field Mapping:
  • Title: $.title
  • Description: $.body
  • Severity: $.alert_type
  • Services: $.tags

Prometheus / Alertmanager

{
  "alerts": [
    {
      "labels": {
        "alertname": "HighMemoryUsage",
        "severity": "warning",
        "service": "backend-api"
      },
      "annotations": {
        "description": "Memory usage is above 85%"
      }
    }
  ]
}
Field Mapping:
  • Title: $.alerts[0].labels.alertname
  • Description: $.alerts[0].annotations.description
  • Severity: $.alerts[0].labels.severity
  • Services: $.alerts[0].labels.service

AWS CloudWatch (via SNS)

{
  "AlarmName": "HighCPUUtilization",
  "AlarmDescription": "CPU utilization exceeded 80%",
  "NewStateValue": "ALARM",
  "Trigger": { "Namespace": "AWS/EC2" }
}
Field Mapping:
  • Title: $.AlarmName
  • Description: $.AlarmDescription
  • Severity: $.NewStateValue
  • Services: $.Trigger.Namespace

Alert Correlation

When multiple alerts arrive within a short time window, CloudThinker automatically correlates them into a single incident.

Time Window Correlation

Groups alerts received within a configurable window (default: 5 minutes). Related alerts increment the correlated_alert_count metric.

Rule-Based Correlation

Define custom rules to match alerts based on:
OperatorDescriptionExample
equalsExact matchservice equals "api"
containsSubstring matchtitle contains "timeout"
regexRegular expressiontitle regex "^DB.*Error$"
starts_withPrefix matchservice starts_with "prod-"
inArray membershipseverity in ["critical", "high"]
intersectsArray overlaptags intersects ["production"]
existsField presencemetadata.deployment_id exists

Correlation Configuration

{
  "enable_correlation": true,
  "correlation_rules": {
    "enabled": true,
    "min_match_weight": 0.5,
    "rules": [
      {
        "name": "Same Service",
        "priority": 1,
        "weight": 0.8,
        "conditions": {
          "operator": "and",
          "items": [
            { "field": "services", "operator": "intersects", "value": [] },
            { "field": "severity", "operator": "in", "value": ["critical", "high"] }
          ]
        }
      }
    ]
  }
}

Deduplication

CloudThinker prevents duplicate incidents using hash-based deduplication.
SettingDefaultDescription
Dedup KeyAuto-generatedSHA256(title + severity + connection_id)
Window24 hoursConfigurable 1-168 hours
BehaviorIncrement countDuplicates update webhook_occurrence_count

Custom Dedup Key

Extract a custom deduplication key from your payload:
{
  "field_mapping": {
    "title": "$.alert.title",
    "dedup_key": "$.alert.fingerprint"
  }
}

Security & Limits

Payload Limits

LimitValue
Max payload size100 KB
Max field length10,000 characters
Max array items100 elements
Max nesting depth10 levels

Rate Limiting

Each webhook has configurable rate limits:
  • Default: 100 requests per hour
  • Configurable: 0 (unlimited) to 10,000 requests per hour
  • Response: HTTP 429 when exceeded

Security Features

  • Timing-safe signature verification prevents timing attacks
  • HTML escaping prevents injection attacks
  • Payload sanitization truncates oversized fields
  • Sensitive header filtering removes auth/cookie headers from logs

Testing Your Integration

1

Open Test Tab

In the webhook configuration dialog, navigate to the Test tab.
2

Review Sample Payload

Each platform has a pre-configured sample payload. Copy and modify as needed.
3

Send Test

Click Send Test to verify field extraction and authentication.
4

Check Results

Success shows extracted fields. Failure shows specific error details.

Webhook Configuration Dialog

After creating a webhook, configure it through four tabs:
TabPurpose
SetupWebhook URL, authentication details, platform-specific setup guide
TestSend test payloads and verify field extraction
Field MappingConfigure JSONPath expressions for incident fields
Delivery LogsMonitor webhook delivery history and response codes

Troubleshooting

IssueSolution
Authentication failedVerify your signing secret or API key matches the source platform exactly
Fields not extractedCheck JSONPath syntax—use $.field[0] for arrays, $.field.subfield for nested objects
Duplicate incidentsAdjust deduplication window or configure explicit dedup_key extraction
Missing severityEnsure severity field maps to recognized values: critical, high, medium, low, info
Rate limit exceededIncrease rate limit in webhook settings or reduce alert volume at source
Payload too largeKeep payloads under 100KB; large fields are automatically truncated

Best Practices

  • Use HMAC authentication when available for stronger security
  • Test with sample payloads before enabling in production
  • Set appropriate severity thresholds for auto-RCA to reduce noise
  • Enable correlation to reduce alert fatigue from cascading failures
  • Monitor delivery logs to catch integration issues early
  • Use explicit dedup keys when your platform provides stable alert identifiers