Supported sources

Remo auto-detects the payload format (parseAlert):

Source Format Detector
Prometheus / Alertmanager {alerts:[{labels,annotations}]} labels present
CloudWatch SNS Notification or alarm JSON Type/AlarmName
Nagios HOSTNAME/SERVICESTATE or host/state/output flags
Zabbix trigger/host flags
Instana event/problem flags
Icinga2 type: StateChange + check_result flags
Generic any payload fallback

Prometheus / Alertmanager (native)

Alertmanager sends its native webhook payload — Remo parses it with parsePrometheusAlerts() (batch {alerts:[...]}).

Alertmanager receiver

route:
  group_by: ['alertname', 'fingerprint']
  receiver: remo

receivers:
  - name: remo
    webhook_configs:
      - url: https://api.remo.sofe.dev/ingest
        send_resolved: false        # only FIRING (no "OK" spam)
        http_config:
          http_headers:
            X-Webhook-Secret:
              values: [whsec_prometheus_acme_xxx]

The parsed alert maps:

  • host ← labels.instance
  • service ← labels.job / alertname
  • severity ← labels.severity (normalized to critical/high/medium/low)
  • description ← annotations.description | summary

What you get

An incident per alert with a full triage_log: ingested → (enriched) → diagnosed → notified → (ticket_created).

Other sources

Send the same POST /ingest with the native payload + your webhook secret:

# Nagios
curl -X POST https://api.remo.sofe.dev/ingest -H "X-Webhook-Secret: whsec_nagios_acme_xxx" \
  -d '{"source":"nagios","host":"db-1","state":"CRITICAL","output":"Disk 98%"}'

# CloudWatch (SNS)
curl -X POST https://api.remo.sofe.dev/ingest -H "X-Webhook-Secret: whsec_cw_acme_xxx" \
  -d '{"Type":"Notification","AlarmName":"CPUHigh","NewStateValue":"ALARM","NewStateReason":"..."}'

Tips

  • Use send_resolved: false to avoid resolved-alert noise.
  • Set for: on Prometheus rules to prevent flapping duplicates.
  • Each source has its own secret in the tenant config — scope per source.
← ArchitectureAI Triage & Enrichment →