Monitoring & RMM intake

The Monitoring & RMM Webhooks extension gives each endpoint an inbound address:

POST https://noots.ai/api/extensions/rmm/<token>

An alert becomes a real ticket on a project's board, with a priority from its severity, an SLA clock attached, an incident chat channel and a notification to the project's people. Configure it all at Org settings → Monitoring & RMM webhooks — see IT & MSP extensions for what it does once the alert is in.

What it accepts

• JSON — the normal case.
• `application/x-www-form-urlencoded` — because UptimeRobot's web-hook alert contact posts form-encoded by default. The same field paths read both.
• Up to 1 MB, at 60 requests per minute per IP.
• A GET returns 405 and tells you to POST.

Pick your tool and the mapping is done

Choose a vendor when you create the endpoint and Noots already knows that tool's field names, its severity words, how it identifies a repeat of the same incident, and how it says an alert has recovered. Built in: PagerDuty, Datadog, Prometheus Alertmanager / Grafana, Zabbix and UptimeRobot.

Everything else uses Custom, where you map the paths yourself — that includes ConnectWise, NinjaOne, Datto, N-able, Atera and Opsgenie, which are deliberately left unmapped. A field path that is subtly wrong maps nothing at all, which looks exactly like a broken integration; we would rather you did it knowingly than trust a guess of ours.

Repeats and recoveries

• A repeat updates the ticket it already opened. The same incident arriving every sixty seconds folds into one ticket with a repeat count, not sixty tickets. It only interrupts anyone again if the severity got worse, in which case the ticket's priority is raised and the incident channel is told.
• The same alert re-delivered — identical incident id — is recognised and does nothing.
• An incident that fires again after its ticket was closed gets a new ticket. It is a new outage.
• A recovery closes the ticket and stops the SLA clock, through the same code the resolve button uses. That happens whether or not SLA timers are still switched on, because a running clock on a closed ticket breaches forever.
• A recovery for something we have no open ticket for is recorded rather than discarded, so a mis-mapped endpoint is diagnosable instead of silent.

Responses