Opsgenie Alert Channel

Create an Opsgenie alert channel to forward Lacework alert data.

note

The instructions in this document reflect the flow for the Standard and Enterprise version of OpsGenie. If you have a Free or Essentials version, the flow and your options to customize the integration might be different. Visit Atlassian Support for more details.

Create an Advanced Integration in Opsgenie

Follow these steps:

Do the following:

1. Log in to Opsgenie.

2. Create an advanced integration from the list of integrations (use "GitHub" for example). Ensure that there is only one Create Alert action, and that it is the only action. You can add more actions later, but they are not necessary to work with Lacework’s data.

3. In the Name field, enter Lacework.

4. Check the Enabled checkbox.

5. In the Filter drop-down, set Match all alerts.

6. In the Message field, enter the following text:

   [Lacework] {{_payload.event_title}}

7. In the Alias field, enter the following text:

   {{id}}

8. In the Priority field, select Custom Value to Opsgenie Priority.

9. In the Mapped Priority Value field, enter the following:

   P{{_payload.event_severity}}

10. In the Source field, enter the following:

    {{_payload.event_source}}

11. In the Description field, enter the following:

    Event Id: {{_payload.event_id}}

    Event Description: {{_payload.event_description}}

    Event Time: {{_payload.event_timestamp}}

    Event Type: {{_payload.event_type}}

    Event Link: {{_payload.event_link}}

    Lacework Account: {{_payload.lacework_account}}

12. In the User field, enter Lacework.

13. Click Save Integration.

Create the Webhook Alert Channel in Lacework

Follow the Lacework Webhook Alert Channel steps to create a custom webhook, inputting the Advanced Integration Opsgenie link as the Webhook URL.