Alert Webhook

The Alert Webhook sends WISdom alert data to an endpoint you control, in a structured JSON format. Unlike the ticketing system integrations, which build message text from templates, the Alert Webhook delivers WISdom-native data fields that your system can parse and route however you need.

Setup has three parts: connect the webhook, create a Notification Channel that points to it, then assign that channel to alert severities on a Profile. WISdom then posts to your endpoint each time a matching alert opens, escalates, de-escalates, or closes.

Before You Begin

• You must have the Admin role. The Integration page is not available to other roles.
• Your endpoint must be reachable over HTTPS from the public internet and must accept POST requests with a JSON body.
• You need an API token that your endpoint will accept as a bearer token.
• If your endpoint sits behind a firewall, allow inbound traffic from the WISdom source IP ranges listed below.

Source IP Ranges

WISdom sends webhook requests from three ranges, distributed across US East 2 and US Central for volume and redundancy. Allow all three.

Key Concepts

Alert scope — Every webhook message identifies whether the alert is a System alert or a Server alert. The scope field carries this value, and it determines which fields are present in the payload.

Event type — Each message is either an AlertOpen or an AlertClose event. All messages for the same alert share the same alertId, so your system can correlate an open with its eventual close.

Alert levels — Alert types that support multiple severity levels generate a message at each transition. An alert configured with three levels can produce an open event, two escalation events, two de-escalation events, and a close event, all carrying the same alertId. Escalations and de-escalations are sent with eventType set to AlertOpen. Only the final close is sent as AlertClose.

Notification Channel — A connected webhook does not deliver anything on its own. You create a Notification Channel that points to it, then assign that channel to alert severities on a Profile.

Step 1 — Connect the Webhook

1. Go to Admin Console › Integration.
2. Under Available Apps, click the WISdom Webhook card. It is labeled Alert Webhook.
3. In the Connect Alert Webhook dialog, complete the fields:

4. Click Test connection. WISdom posts a complete sample payload to your endpoint. The message field contains wording that clearly identifies it as a test message.
5. Click Save.

The webhook moves from Available Apps to Connected Apps, and the card displays the name you assigned.

Step 2 — Assign the Webhook to a Notification Channel

Connecting the webhook makes it selectable when you build a Notification Channel. No alerts are sent until you create and assign that channel.

1. Go to Admin Console › Monitoring › Notification Channels.
2. Expand the Ticketing System section and add a channel.
3. Enter a Name for the channel. This is the name that appears in the Profile channel picker.
4. Open the Ticketing System drop-down and select your webhook by the name you gave it in Step 1.
5. Save the channel.

Step 3 — Assign the Channel to a Profile

1. Go to Admin Console › Monitoring › Profiles and edit the Profile you want to use.
2. Either select the Notifications radio button, or step through to Notifications.
3. For each severity you want delivered, open the Channels drop-down under Notify on Open Events, Notify on Closed Events, or both. Select your channel and click Apply.
4. Click Save.

Managing a Connected Webhook

Hover over the webhook card under Connected Apps to reveal the edit and delete icons.

• Edit opens the Edit Connected Alert Webhook dialog, where you can change the name, endpoint, or token. The stored token is masked. Test connection is available here as well.
• Delete removes the webhook. Any Notification Channel pointing to it will stop delivering, and any Profile severity using that channel will no longer notify. Update those references first.

Request Format

WISdom sends an HTTP POST with a JSON body and the following headers:

If you set the token to my-token, WISdom sends Authorization: Bearer my-token.

Delivery and Retries

If your endpoint does not respond successfully, WISdom retries the request twice using exponential backoff. After the final attempt, the message is dropped.

Payload Reference

Fields Common to All Alerts

Server Alert Fields

Opening alertDetailsUrl resolves to Health › Alerts › Details for that specific alert, with the Alert Details flyout already open. For MSP accounts, the link also resolves to the correct client account. Use the value exactly as provided rather than constructing the URL yourself, as the link format is subject to change.

System Alert Fields

Sample Payloads

Server Alert

{
    "alertId": "WBg6NSK8XPBCQHHovmB7ow==",
    "eventType": "AlertOpen",
    "scope": "Server",
    "accountName": "ABC Industries",
    "accountDisplayName": "ABC",
    "openDateTime": "2025-01-01T00:00:00Z",
    "closeDateTime": null,
    "alertType": "Low Disk Space",
    "message": "This is a sample server alert",
    "serverName": "Server1",
    "targetObjectName": "C:",
    "platformName": "Microsoft SQL Server",
    "failureCount": 1,
    "successCount": 0,
    "alertDetailsUrl": "https://app.fortifiedwisdom.com/health/alerts_details/{alert-specific-link}"
}

System Alert

{
    "alertId": "WBg6NSK8XPBCQHHovmB7ow==",
    "eventType": "AlertOpen",
    "scope": "System",
    "accountName": "ABC Industries",
    "accountDisplayName": "ABC",
    "openDateTime": "2025-01-01T00:00:00Z",
    "closeDateTime": null,
    "alertType": "Sample system alert type",
    "message": "This is a sample system alert",
    "collectorMachineName": "Machine1",
    "collectorName": "Collector1"
}

Troubleshooting

Related Topics

• Integration
• Notification Channels
• Profiles
• Alert Rules
• Account