Last9

Overview

This document provides a detailed guide to integrating Last9 with Callgoose SQIBS for real-time Incident Management, metric-based alerting, and automated incident resolution.

The integration uses Last9 Webhooks to send alert event payloads directly to Callgoose, where API Filters convert them into incidents that are automatically created and resolved.

Prerequisites

Before beginning, ensure you have the following:

• A Callgoose SQIBS account with permissions to create API Filters and access the integration endpoint.
• A Last9 account with admin-level access to Alerts and Integrations.
• A valid Callgoose API token and API endpoint URL.
• A test Last9 alert rule for verifying webhook delivery and payload structure.

1. Prepare Callgoose: Obtain Endpoint and Token

1.1 Retrieve Callgoose API Endpoint

Generate or locate your Callgoose process endpoint:

https://****.callgoose.com/v1/process?from=Last9&token=xxxx

Store the API token securely and never commit it to source control.

2. Configure Last9 Webhook

Last9 supports outbound Webhook notifications for metric alerts, threshold breaches, and anomaly detections.

2.1 Choose Webhook Scope

You can configure the webhook at:

• Global Integration level
• Alerts → Create Alert → Add Notification → Webhook
• Individual alert rules

Last9 alerts support multiple condition types including thresholds, comparisons, and time-window evaluations.

2.2 Configure Webhook Fields

Set the following:

• Webhook URL:
• Use the Callgoose endpoint from Step 1.
• HTTP Method:
• POST
• Content Type:
• application/json
• Send Resolved Alerts:
• Enable this to ensure Callgoose can auto-resolve incidents.
• Save the webhook after configuration.

2.3 Optional Verification Headers

Last9 may include optional headers such as:

• X-Last9-Signature
• X-Last9-Event
• X-Last9-Source

These can be used to validate authenticity if a proxy or gateway is used.

3. Example Last9 Payloads

Below is a standard webhook payload generated by Last9 for alert rules.

Trigger (firing) Example

{
  "status": "firing",
  "alert_name": "High Error Rate",
  "alert_id": "last9-alert-321",
  "severity": "critical",
  "description": "Error rate exceeded 5% threshold",
  "timestamp": "2025-10-01T12:05:00Z",
  "labels": {
    "service": "auth-service",
    "env": "prod"
  },
  "values": {
    "error_rate": 7.2
  }
}

Resolve Example

{
  "status": "resolved",
  "alert_name": "High Error Rate",
  "alert_id": "last9-alert-321",
  "timestamp": "2025-10-01T12:18:44Z"
}

Actual fields can vary based on the alert configuration.

Use the exact field names visible in the Callgoose API Logs.

4. Create API Filters in Callgoose SQIBS

Callgoose API Filters convert incoming Last9 alerts into incidents.

Use two filters:

• Trigger Filter → create incident
• Resolve Filter → auto-resolve incident

4.1 Trigger Filter — Create Incident

• Payload JSON Key: "status"
• Key Value Contains: firing
• Map Incident With: "alert_id"
• Incident Title: "alert_name"
• Incident Description: "description" (optional — leaving empty uses full JSON)

This filter creates an incident whenever Last9 triggers an alert.

4.2 Resolve Filter — Auto-Resolve Incident

• Payload JSON Key: "status"
• Key Value Contains: resolved
• Incident Mapped With: "alert_id"

This ensures the matching incident is resolved when Last9 sends a resolved event.

5. Verify and Test the Integration

5.1 Test Initial Delivery

• Create a broad test filter in Callgoose.
• Send a test webhook from Last9.
• Confirm Callgoose receives the payload in API Logs.

5.2 View Exact Payload

Use the API request logs inside Callgoose to inspect:

• Field names
• Nested objects
• Timestamps
• Status values

Use these directly when configuring filters.

5.3 Final Verification

• Trigger a condition in Last9 → Callgoose must create an incident.
• Restore normal conditions → Callgoose must auto-resolve the incident.
• Confirm that the same alert_id is used throughout.

6. Troubleshooting

Incoming Payload Not Received

• Check Last9 webhook logs.
• Verify endpoint URL and token.
• Ensure POST requests are allowed to Callgoose.
• Confirm no SSL/TLS restriction issues.

Incidents Not Auto-Resolving

• Confirm Last9 is sending "status": "resolved".
• Ensure the Resolve Filter matches the correct key/value.
• Check that the alert_id is identical for firing and resolved events.

Wrong or Missing Payload Fields

• Inspect payloads in Callgoose API Logs.
• Update filter mappings to match the exact JSON structure.
• Re-trigger firing and resolved events.

7. Conclusion

Integrating Last9 with Callgoose SQIBS provides real-time incident automation based on metric alerts and threshold breaches.

By configuring Last9 Webhook notifications and mapping them through Callgoose API Filters, teams gain immediate visibility into performance issues, anomalies, and service degradations.

The combination of Trigger and Resolve filters ensures incidents are created and closed seamlessly, improving operational reliability and reducing manual effort.

For further customization or advanced use cases, refer to the official documentation for both Last9 and Callgoose SQIBS:

• Last9 Documentation
• Callgoose SQIBS API Token Documentation
• Callgoose SQIBS API Endpoint Documentation
• API Filter Instructions and FAQ
• How to Send API