Grafana

Connect your own Grafana (self-hosted, or Grafana Cloud) as a source the investigator agent reads from during an incident — reaching not just Grafana itself, but every datasource Grafana already has configured (Prometheus, Loki, Tempo, or anything else Landfall has no dedicated adapter for), proxied through Grafana's own query API.

Why connect Grafana, not just its datasources directly

If you already run Grafana, it very likely aggregates more than Landfall has native plugins for. Connecting it directly to the same Prometheus and Loki you might also connect separately adds no new reach — the real value is querying through Grafana to whatever else it has configured that Landfall doesn't have a dedicated adapter for. The investigator agent discovers your Grafana's datasource list first, then queries through whichever one is relevant to the incident, exactly as a human would in Grafana's own Explore view.

Connecting Grafana as a queryable source

An organization connects Grafana the same way every other telemetry source is connected: through the integrations wizard, authenticated with a Grafana service account token — Grafana's own modern replacement for legacy API keys. Once connected, the investigator agent can query it during an incident with zero source-specific agent code — the same dynamic-discovery mechanism every other source uses (see Integrations architecture).

What you'll need

• A Grafana instance reachable FROM Landfall — the same genuine limitation already documented for Prometheus and Loki: a Grafana running inside your own private network is typically not reachable from a hosted Landfall the way a public SaaS API is.
• A Grafana service account with the Viewer role — Grafana itself enforces read-only at that role, independent of anything Landfall chooses to call. A broader role works too, but Landfall never calls a write endpoint regardless of what the token could technically do.
• An admin on your Landfall organization, to save the connection under Settings → Integrations.

1. Create a Grafana service account token

Landfall only ever reads through Grafana: it verifies the token is alive and then proxies queries when an incident is being investigated. Give it a service account scoped to match — Viewer, not Admin or Editor.

1. Administration → Users and access → Service accounts

   Click Add service account, give it a name you'll recognize later (e.g. landfall-signals), and leave the role at its default of Viewer.

2. Add service account token

   On the new service account's page, click Add service account token. No expiration is required, but setting one is a reasonable default if your organization rotates credentials on a schedule.

   Administration → Service accounts → landfall-signals

   

2. Add it to Landfall

In Landfall, open Settings → Integrations → Grafana for your organization. It asks for exactly two things: your Grafana's base URL, and the token you just created.

1. Base URL + service account token

   Settings → Integrations → Grafana

   

2. Test connection

   Landfall calls your Grafana's own /api/datasources endpoint before saving anything — deliberately not /api/health, which answers 200 even for a garbage or missing token. A Grafana that can't be reached, or that rejects the supplied token, is refused outright rather than stored as "configured but unverified."

   Settings → Integrations → Grafana

   

3. Save integration

   Grafana now shows Configured alongside your organization's other connectors, and appears in the capability listing an incident's investigator (human or Beacon) can query against.

   Settings → Integrations

   

Alerting → incidents

Connecting Grafana (above) lets the investigator agent query through it during an investigation. Opening an incident automatically the moment a Grafana Unified Alerting rule fires is a separate, independent capability — configured with a contact point pointing at the exact same Alertmanager a Prometheus or Loki alerting rule already notifies. See Triggering Integrations → Alertmanager for that setup, including Grafana's own addition to it. The two are independent; most teams eventually set up both.

Reference