Firing Datadog and Coralogix alerts into Landfall

This page is about opening incidents automatically the moment a Datadog monitor or a Coralogix alert fires. It is not about reading telemetry — if you want the investigation agent to query your data once an incident already exists, see Connecting Coralogix or Connecting AWS instead. The two are independent, and most teams eventually set up both.

How it works

Both platforms send outbound webhooks whose body is a template you write, not a fixed schema. That is the whole reason this page exists: Landfall can only map an alert it recognizes, so the JSON you paste into your platform has to carry the field names below. Get the template right once and every subsequent alert works; get it wrong and you will see a 422 with no incident created.

Both platforms post to the same endpoint — POST /triggers — authenticated by a per-tenant bearer token. Landfall works out which platform sent the alert from the shape of the body, not from a URL path, a query parameter or a header, so there is one URL and one token for every source. The same endpoint also accepts CloudWatch alarms (see CloudWatch alerts).

What you'll need

• An admin seat on your Landfall organization, to mint the ingest token below.
• Permission to add an outbound webhook in Datadog (Integrations → Webhooks) or Coralogix (Integrations → Outbound Webhooks).
• At least one monitor or alert already configured — this guide doesn't create one.

1. Mint a trigger ingest token

This doesn't have a settings-page UI yet, so it's two API calls, made once with your own Landfall account: sign in to get a session token, then use that session token to mint the actual ingest token.

SESSION=$(curl -s -X POST https://api.landfalls.ai/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"<you>","password":"<your password>","orgSlug":"<your-org>"}' \
  | jq -r .accessToken)

curl -X POST https://api.landfalls.ai/o/<your-org>/triggers/ingest-token \
  -H "Authorization: Bearer $SESSION"

If your organization signs in through SSO instead, there is no password to hand curl: sign in normally in your browser, then open devtools and read localStorage.getItem('landfall.accessToken') for a session token to use as $SESSION above.

2. Datadog

In Datadog, go to Integrations → Webhooks and add a new webhook. Datadog requires custom headers to be JSON, which is how the bearer token gets attached.

Paste this into the Payload field:

{
  "title": "$ALERT_TITLE",
  "alert_type": "$ALERT_TYPE",
  "priority": "$ALERT_PRIORITY",
  "body": "$EVENT_MSG",
  "tags": ["service:$TAGS[service]"]
}

What Datadog's fields become

Landfall recognizes a body as Datadog's when it carries an alert_type string or a tags array, so keep at least alert_type in the template even if you drop everything else.

3. Coralogix

In Coralogix, go to Integrations → Outbound Webhooks → Generic Webhook, then attach the webhook to the alerts you want to open incidents.

Paste this into the webhook body:

{
  "alertName": "$ALERT_NAME",
  "severity": "$EVENT_SEVERITY",
  "applicationName": "$APPLICATION_NAME",
  "subsystemName": "$SUBSYSTEM_NAME",
  "query": "$QUERY_TEXT"
}

What Coralogix's fields become

Recognition needs at least one of alertName, applicationName or subsystemName to be present and non-empty. A body carrying only generic fields like severity or query is deliberately not accepted as Coralogix — those names are too common to prove where the alert came from, and guessing would mean filing someone else's payload as a Coralogix incident.

4. Test it

Both platforms have a "test" button that sends the template with placeholder values, which is worth clicking. To check the mapping itself, post a realistic filled-in body yourself — this is exactly what your platform will send once the placeholders render:

curl -i -X POST https://api.landfalls.ai/triggers \
  -H "Authorization: Bearer <your ingest token>" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "[P2] 5xx rate above 2% on web-edge",
    "alert_type": "error",
    "priority": "P2",
    "body": "5xx rate 4.1% over the last 5 minutes, threshold 2%.",
    "tags": ["service:web-edge"]
  }'

Opens an incident titled [P2] 5xx rate above 2% on web-edge at sev2 (from P2), about the service web-edge.

curl -i -X POST https://api.landfalls.ai/triggers \
  -H "Authorization: Bearer <your ingest token>" \
  -H "Content-Type: application/json" \
  -d '{
    "alertName": "Checkout error spike",
    "severity": "Critical",
    "applicationName": "checkout",
    "subsystemName": "payments",
    "query": "level:error AND service:checkout"
  }'

Opens an incident titled Checkout error spike at sev1 (from Critical), about the service checkout.

Troubleshooting

Reference