22e66c4be · cryptotaxi247/netdata-1

@@ -25,7 +25,7 @@ To add discord notification configurations you need

25 1. **Integration configuration** are the specific notification integration required settings, which vary by notification method. For webhook:

26 - Webhook URL - webhook URL is the url of the service that Netdata will send notifications to. In order to keep the communication secured, we only accept HTTPS urls. Check [how to create the webhook service](#webhook-service).

27 - Extra headers - these are optional key-value pairs that you can set to be included in the HTTP requests sent to the webhook URL. For mode details check [Extra headers](#extra-headers)

28 - - Authorization Mechanism - Netdata webhook integration supports 3 different authorization mechanisms. For mode details check [Authorization mechanism](#authorization-mechanism):

28 + - Authentication Mechanism - Netdata webhook integration supports 3 different authentication mechanisms. For mode details check [Authentication mechanisms](#authentication-mechanisms):

29 - Mutual TLS (recommended) - default authentication mechanism used if no other method is selected.

30 - Basic - the client sends a request with an Authorization header that includes a base64-encoded string in the format **username:password**. These will settings will be required inputs.

31 - Bearer - the client sends a request with an Authorization header that includes a **bearer token**. This setting will be a required input.

@@ -50,13 +50,14 @@ The notification content sent to the destination service will be a JSON object h

50 | chart | string | The chart associated with the alert. |

51 | context | string | The chart context. |

52 | space | string | The space where the node that raised the alert is assigned. |

53 +| rooms | object[object(string,string)] | Object with list of rooms names and urls where the node belongs to. |

54 | family | string | Context family. |

55 | class | string | Classification of the alert, e.g. "Error". |

56 | severity | string | Alert severity, can be one of "warning", "critical" or "clear". |

57 | date | string | Date of the alert in ISO8601 format. |

58 | duration | string | Duration the alert has been raised. |

58 -| critical_count | integer | umber of critical alerts currently existing on the same node. |

59 -| warning_count | integer | Number of warning alerts currently existing on the same node. |

59 +| additional_active_critical_alerts | integer | Number of additional critical alerts currently existing on the same node. |

60 +| additional_active_warning_alerts | integer | Number of additional warning alerts currently existing on the same node. |

61 | alarm_url | string | Netdata Cloud URL for this alarm. |

62

63 ### Extra headers

@@ -69,22 +70,165 @@ By default, the following headers will be sent in the HTTP request

70 |:-------------------------------:|-----------------------------|

71 | Content-Type | application/json |

72

72 -### Authorization mechanism

73 +### Authentication mechanisms

74

74 -Netdata webhook integration supports 3 different authorization mechanisms:

75 +Netdata webhook integration supports 3 different authentication mechanisms:

76

76 -1. Mutual TLS (recommended)

77 +#### Mutual TLS authentication (recommended)

78

78 -In mutual Transport Layer Security (mTLS) authorization, the client and the server authenticate each other using X.509 certificates. This ensures that the client is connecting to the intended server, and that the server is only accepting connections from authorized clients.

79 -

80 -To take advantage of mutual TLS, you can configure your server to verify Netdata's client certificate. To do that you need to download our [CA certificate file](http://localhost) and configure your server to use it as the

79 +In mutual Transport Layer Security (mTLS) authentication, the client and the server authenticate each other using X.509 certificates. This ensures that the client is connecting to the intended server, and that the server is only accepting connections from authorized clients.

80

81 This is the default authentication mechanism used if no other method is selected.

82

84 -2. Basic

83 +To take advantage of mutual TLS, you can configure your server to verify Netdata's client certificate. In order to achieve this, the Netdata client sending the notification supports mutual TLS (mTLS) to identify itself with a client certificate that your server can validate.

84 +

85 +The steps to perform this validation are as follows:

86 +

87 +- Store Netdata CA certificate on a file in your disk. The content of this file should be:

88 +

89 +<details>

90 + <summary>Netdata CA certificate</summary>

91 +

92 +```

93 +-----BEGIN CERTIFICATE-----

94 +MIIF0jCCA7qgAwIBAgIUDV0rS5jXsyNX33evHEQOwn9fPo0wDQYJKoZIhvcNAQEN

95 +BQAwgYAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH

96 +Ew1TYW4gRnJhbmNpc2NvMRYwFAYDVQQKEw1OZXRkYXRhLCBJbmMuMRIwEAYDVQQL

97 +EwlDbG91ZCBTUkUxGDAWBgNVBAMTD05ldGRhdGEgUm9vdCBDQTAeFw0yMzAyMjIx

98 +MjQzMDBaFw0zMzAyMTkxMjQzMDBaMIGAMQswCQYDVQQGEwJVUzETMBEGA1UECBMK

99 +Q2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEWMBQGA1UEChMNTmV0

100 +ZGF0YSwgSW5jLjESMBAGA1UECxMJQ2xvdWQgU1JFMRgwFgYDVQQDEw9OZXRkYXRh

101 +IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCwIg7z3R++

102 +ppQYYVVoMIDlhWO3qVTMsAQoJYEvVa6fqaImUBLW/k19LUaXgUJPohB7gBp1pkjs

103 +QfY5dBo8iFr7MDHtyiAFjcQV181sITTMBEJwp77R4slOXCvrreizhTt1gvf4S1zL

104 +qeHBYWEgH0RLrOAqD0jkOHwewVouO0k3Wf2lEbCq3qRk2HeDvkv0LR7sFC+dDms8

105 +fDHqb/htqhk+FAJELGRqLeaFq1Z5Eq1/9dk4SIeHgK5pdYqsjpBzOTmocgriw6he

106 +s7F3dOec1ZZdcBEAxOjbYt4e58JwuR81cWAVMmyot5JNCzYVL9e5Vc5n22qt2dmc

107 +Tzw2rLOPt9pT5bzbmyhcDuNg2Qj/5DySAQ+VQysx91BJRXyUimqE7DwQyLhpQU72

108 +jw29lf2RHdCPNmk8J1TNropmpz/aI7rkperPugdOmxzP55i48ECbvDF4Wtazi+l+

109 +4kx7ieeLfEQgixy4lRUUkrgJlIDOGbw+d2Ag6LtOgwBiBYnDgYpvLucnx5cFupPY

110 +Cy3VlJ4EKUeQQSsz5kVmvotk9MED4sLx1As8V4e5ViwI5dCsRfKny7BeJ6XNPLnw

111 +PtMh1hbiqCcDmB1urCqXcMle4sRhKccReYOwkLjLLZ80A+MuJuIEAUUuEPCwywzU

112 +R7pagYsmvNgmwIIuJtB6mIJBShC7TpJG+wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMC

113 +AQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU9IbvOsPSUrpr8H2zSafYVQ9e

114 +Ft8wDQYJKoZIhvcNAQENBQADggIBABQ08aI31VKZs8jzg+y/QM5cvzXlVhcpkZsY

115 +1VVBr0roSBw9Pld9SERrEHto8PVXbadRxeEs4sKivJBKubWAooQ6NTvEB9MHuGnZ

116 +VCU+N035Gq/mhBZgtIs/Zz33jTB2ju3G4Gm9VTZbVqd0OUxFs41Iqvi0HStC3/Io

117 +rKi7crubmp5f2cNW1HrS++ScbTM+VaKVgQ2Tg5jOjou8wtA+204iYXlFpw9Q0qnP

118 +qq6ix7TfLLeRVp6mauwPsAJUgHZluz7yuv3r7TBdukU4ZKUmfAGIPSebtB3EzXfH

119 +7Y326xzv0hEpjvDHLy6+yFfTdBSrKPsMHgc9bsf88dnypNYL8TUiEHlcTgCGU8ts

120 +ud8sWN2M5FEWbHPNYRVfH3xgY2iOYZzn0i+PVyGryOPuzkRHTxDLPIGEWE5susM4

121 +X4bnNJyKH1AMkBCErR34CLXtAe2ngJlV/V3D4I8CQFJdQkn9tuznohUU/j80xvPH

122 +FOcDGQYmh4m2aIJtlNVP6+/92Siugb5y7HfslyRK94+bZBg2D86TcCJWaaZOFUrR

123 +Y3WniYXsqM5/JI4OOzu7dpjtkJUYvwtg7Qb5jmm8Ilf5rQZJhuvsygzX6+WM079y

124 +nsjoQAm6OwpTN5362vE9SYu1twz7KdzBlUkDhePEOgQkWfLHBJWwB+PvB1j/cUA3

125 +5zrbwvQf

126 +-----END CERTIFICATE-----

127 +```

128 +</details>

129 +

130 +- Enable client certificate validation on the web server that is doing the TLS termination. Below we show you how to perform this configuration in `NGINX` and `Apache`

131 +

132 + **NGINX**

133 +

134 +```bash

135 +server {

136 + listen 443 ssl default_server;

137 +

138 + # ... existing SSL configuration for server authentication ...

139 + ssl_verify_client on;

140 + ssl_client_certificate /path/to/Netdata_CA.pem;

141 +

142 + location / {

143 + if ($ssl_client_s_dn !~ "CN=api.netdata.cloud") {

144 + return 403;

145 + }

146 + # ... existing location configuration ...

147 + }

148 +}

149 +```

150 +

151 +**Apache**

152 +

153 +```bash

154 +Listen 443

155 +<VirtualHost *:443>

156 + # ... existing SSL configuration for server authentication ...

157 + SSLVerifyClient require

158 + SSLCACertificateFile "/path/to/Netdata_CA.pem"

159 +</VirtualHost>

160 +<Directory /var/www/>

161 + Require expr "%{SSL_CLIENT_S_DN_CN} == 'api.netdata.cloud'"

162 + # ... existing directory configuration ...

163 +</Directory>

164 +```

165 +

166 +#### Basic authentication

167

168 In basic authorization, the client sends a request with an Authorization header that includes a base64-encoded string in the format username:password. The server then uses this information to authenticate the client. If this authentication method is selected, the user can set the user and password that will be used when connecting to the destination service.

169

88 -3. Bearer

170 +#### Bearer token authentication

171 +

172 +In bearer token authentication, the client sends a request with an Authorization header that includes a bearer token. The server then uses this token to authenticate the client. Bearer tokens are typically generated by an authentication service, and are passed to the client after a successful authentication. If this method is selected, the user can set the token to be used for connecting to the destination service.

173 +

174 +##### Challenge secret

175 +

176 +To validate that you has ownership of the web application that will receive the webhook events, we are using a challenge response check mechanism.

177 +

178 +This mechanism works as follows:

179 +

180 +- The challenge secret parameter that you provide is a shared secret between you and Netdata only.

181 +- On your request for creating a new Webhook integration, we will make a GET request to the url of the webhook, adding a query parameter `crc_token`, consisting of a random string.

182 +- You will receive this request on your application and it must construct an encrypted response, consisting of a base64-encoded HMAC SHA-256 hash created from the crc_token and the shared secret. The response will be in the format:

183 +

184 +```json

185 +{

186 + "response_token": "sha256=9GKoHJYmcHIkhD+C182QWN79YBd+D+Vkj4snmZrfNi4="

187 +}

188 +```

189 +

190 +- We will compare your application's response with the hash that we will generate using the challenge secret, and if they are the same, the integration creation will succeed.

191 +

192 +We will do this validation everytime you update your integration configuration.

193 +

194 +- Response requirements:

195 + - A base64 encoded HMAC SHA-256 hash created from the crc_token and the shared secret.

196 + - Valid response_token and JSON format.

197 + - Latency less than 5 seconds.

198 + - 200 HTTP response code.

199 +

200 +**Example response token generation in Python:**

201 +

202 +Here you can see how to define a handler for a Flask application in python 3:

203 +

204 +```python

205 +import base64

206 +import hashlib

207 +import hmac

208 +import json

209 +

210 +key ='YOUR_CHALLENGE_SECRET'

211 +

212 +@app.route('/webhooks/netdata')

213 +def webhook_challenge():

214 + token = request.args.get('crc_token').encode('ascii')

215 +

216 + # creates HMAC SHA-256 hash from incomming token and your consumer secret

217 + sha256_hash_digest = hmac.new(key.encode(),

218 + msg=token,

219 + digestmod=hashlib.sha256).digest()

220 +

221 + # construct response data with base64 encoded hash

222 + response = {

223 + 'response_token': 'sha256=' + base64.b64encode(sha256_hash_digest).decode('ascii')

224 + }

225 +

226 + # returns properly formatted json response

227 + return json.dumps(response)

228 +```

229 +

230 +#### Related topics

231

90 -In bearer token authorization, the client sends a request with an Authorization header that includes a bearer token. The server then uses this token to authenticate the client. Bearer tokens are typically generated by an authentication service, and are passed to the client after a successful authentication. If this method is selected, the user can set the token to be used for connecting to the destination service.

232 +- [Alerts Configuration](https://github.com/netdata/netdata/blob/master/health/README.md)

233 +- [Alert Notifications](https://github.com/netdata/netdata/blob/master/docs/cloud/alerts-notifications/notifications.mdx)

234 +- [Manage notification methods](https://github.com/netdata/netdata/blob/master/docs/cloud/alerts-notifications/manage-notification-methods.md)

added Challenge secret and rooms object on the payload (#14496)