Dynamic variables

The use of variables in notification integrations can be done through tokens. Notification integrations contain customizable payloads where you can add, remove and change tokens and text.

The information and tokens in the payload determine what information is populated into your alert or incident. For example:

• {alert_name} was triggered at {alert_timestamp}, this populates the alert with the name you have given the alert and the time in UTC when the alert was generated: "404 alert was triggered at 21/04/2023T12:35:36".

The tables below details the different variables you can use in a payload.

Alerts

Incidents

Example incident message for Slack

{
    "blocks": [
        {
            "type": "header",
            "text": {
                "type": "plain_text",
                "text": "Incident Triggered by Policy '{incident_policy_name}'",
                "emoji": true
            }
        },
        {
            "type": "section",
            "fields": [
                {
                    "type": "mrkdwn",
                    "text": "*Name:*\n{incident_title}"
                },
                {
                    "type": "mrkdwn",
                    "text": "*Trigger Time:*\n{incident_timestamp}"
                }
            ]
        },
        {
            "type": "header",
            "text": {
                "type": "plain_text",
                "text": "Findings - {incident_findings_total_count}"
                "emoji": true
            }
        },
        {
            "type": "section",
            "fields": [
                {
                    "type": "mrkdwn",
                    "text": "*Critical:*\n{incident_findings_critical_count}"
                },
                {
                    "type": "mrkdwn",
                    "text": "*High:*\n{incident_findings_high_count}"
                },
                {
                    "type": "mrkdwn",
                    "text": "*Medium:*\n{incident_findings_medium_count}"
                },
                {
                    "type": "mrkdwn",
                    "text": "*Low:*\n{incident_findings_low_count}"
                }
            ]
        },
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": "<{incident_link}|View Incident>"
            }
        }
    ]
}