Alert Ingestion

The alert ingestion integration receives webhook notifications from your existing alerting tools and automatically creates, correlates, and resolves incidents in BlameTrail. Alerts from multiple providers are normalized into a common format, deduplicated by fingerprint, and correlated to your services.

Supported providers

How it works

1. Create a token — Generate an alert ingest token in Settings > Integrations > Alert Ingestion. One token works across all provider endpoints.
2. Configure your alerting tool — Point your provider's webhook URL to the appropriate BlameTrail endpoint and include the token in the X-Alert-Token header.
3. Alerts flow in — BlameTrail receives alerts, normalizes them, deduplicates by fingerprint, and creates or correlates incidents automatically.
4. Auto-resolution — When a resolve event arrives (or after 24 hours of silence), the associated incident is automatically resolved.

Endpoints

All endpoints accept POST requests at https://blametrail.com/api/alerts/ingest/<provider>:

Incident creation rules

Not every alert immediately creates an incident. BlameTrail uses severity-based thresholds to reduce noise:

If an open incident already exists for the same service, new alerts are correlated to it rather than creating duplicates. Severity is automatically escalated (never downgraded) when more severe alerts arrive.

Plan limits