Webhook adapters
Google Cloud Monitoring
Send Google Cloud Monitoring alerts to WarnFire — an opening incident pages your responder and its closure resolves it.
If you run on Google Cloud and watch it with Cloud Monitoring alerting policies, this page connects them to WarnFire so a firing policy opens an incident and pages your on-call responder — and the closure resolves it automatically.
Alerts, not logs. WarnFire consumes Cloud Monitoring alerting incidents — an alerting policy that opens an incident. It does not read your raw logs or metrics. Set up the alerting policies that matter, and WarnFire pages on those.
Google delivers alerts through a notification channel of type Webhook, attached to your alerting policies.
Before you begin
- A WarnFire service and integration key for these alerts. If you do not have one, create the service and its first key .
- Permission in Google Cloud to create a notification channel and attach it to alerting policies.
Your WarnFire address
Cloud Monitoring’s webhook can’t attach a security header, so your integration key goes in the address:
https://api.warnfire.com/v1/integrations/webhooks/gcp/wf_live_your_integration_key_here
Treat that whole address as a secret — anyone who has it can open incidents on your service. If it’s ever exposed, revoke the key under Services and use a fresh one.
Connect Cloud Monitoring to WarnFire
- In the Google Cloud console, open Monitoring → Alerting → Edit notification channels.
- Under Webhooks, select Add new and fill it in:
- Endpoint URL: your WarnFire address from above.
- Display name:
WarnFire. - Leave Use HTTP Basic Auth off. (If you prefer Google’s token-auth field instead of putting the key in the path, set the endpoint to
https://api.warnfire.com/v1/integrations/webhooks/gcpand Google will add your token as?auth_token=…— WarnFire accepts either.)
- On each alerting policy that should page, add the WarnFire webhook channel under Notifications, and turn on Notify on incident closure so resolutions reach WarnFire (see below).
How your alerts become incidents
WarnFire turns each Cloud Monitoring incident into one WarnFire incident, using the incident’s own ID so its states stay together:
- When the incident opens (
state: open), the WarnFire incident opens and paging starts. - When the incident closes (
state: closed), the same incident is resolved. - A repeat notification for a still-open incident updates it rather than opening a duplicate.
Turn on incident-closure notifications. By default a policy notifies only when a Cloud Monitoring incident opens. Enable Notify on incident closure on each policy so WarnFire receives both ordinary recovery closures and closures produced by Google Cloud’s own incident autoclose behavior. Without that notification, the WarnFire incident stays open even if Google Cloud closes its copy; an authorized operator must force-resolve it with a reason .
What shows up on the incident
WarnFire maps your Cloud Monitoring incident to the WarnFire incident automatically:
| On the incident | Comes from |
|---|---|
| Title | The condition name (falling back to the policy name, then the alert summary) |
| Severity | The incident severity: Critical → critical, Error → error, Warning → warning. With no severity set, it pages as critical. |
| Description | The incident summary (falls back to the documentation) |
| Source | The affected resource name |
| Component | The metric display name |
| Environment | An environment, env, or stage label on the resource or policy |
| Link | View in Cloud Monitoring — the incident’s console URL |
| Labels · Details | The resource and metric labels, policy name, threshold, and observed value |
Verify it worked
- Follow Test before you connect , choose gcp, and confirm the preview maps the expected action, title, severity, correlation key, and metadata. Preview does not select or verify a service.
- Choose the intended service for Send test, send the confirmed test, and verify that one test incident opens for that service and pages its on-call responder.
- Open and close a disposable Cloud Monitoring alerting incident. Confirm that one WarnFire incident opens and that the same incident closes.
Send test, Google’s test notification, and a disposable alert use a real incident path. They can page responders; selected SMS and voice deliveries consume allowance or prepaid credits and can invoke configured auto-recharge. Notify the responder before testing.
If alerts don’t arrive
| What you see | What it means |
|---|---|
| Test notification sent but no incident opens | The endpoint URL is wrong or missing the key. Re-check the address, including the key on the end (or the auth_token). |
| Incidents open but never close | Notify on incident closure isn’t enabled on the policy. Turn it on. |
| 401 returned to the webhook | The integration key is wrong, expired, or revoked. Use a fresh address. |
| 429 returned to the webhook | The trigger-rate limit or maximum active-incident limit was reached. Check Limits and protections and resolve stale incidents before retrying. |
Next steps
Use Preview a mapping again before changing the notification channel or alerting policy in production.