Creating a Post to Slack with the "Post" action to a web server

jm_sysadmin

I was recently asked how we could send a post directly to a Slack channel's webhook from Orion. I thought it should work, even though mostly I use PowerShell or the integration that posts email. 

I set up an alert and tested it with the "Send a Get or POST Request to a Web Server" action. 

If you need a webhook URL, read over Incoming webhooks for Slack and that process will get you the URL. 

Since I had one already to a test channel, I started to configure my alert.

Like anything you name it, and the first line for URL is that webhook address. Use the Post action, and you get a body to post into. We will talk about that in a minute. Slack rolls all the authentication into that URL, so you won't need that, but you do need to set the ContentType to: application/json which allows the receiving end to know how to parse it. If you want stronger authentication , you likely want to read up on making a Slack Application, we won't dig deeper here. 

At this point, I want to know that I can get data to slack, so I start with simple messages. Most of what I tested came from their documentation, I just copied the payload in, and made the Node down alert trip. 

My first body to post was below, you want everything including the curly brackets. 

{"text": "A very important thing has occurred!  for details!"}

I poked around in the documents a bit more, and came up with this: 

{
	"blocks": [
		{
			"type": "header",
			"text": {
				"type": "plain_text",
				"text": ":small_red_triangle_down: Node Down",
				"emoji": true
			}
		},
		{
			"type": "context",
			"elements": [
				{
					"type": "mrkdwn",
					"text": "*<${N=SwisEntity;M=DetailsUrl}|${N=SwisEntity;M=Caption}>* is ${N=SwisEntity;M=Status} \n  Type:  \n  \n "
				}
			]
		},
		{
			"type": "section",
			"text": {
				"type": "mrkdwn",
				"text": "<${N=Alerting;M=AlertDetailsUrl}|Alert Details>"
			}
		},
		{
			"type": "section",
			"text": {
				"type": "mrkdwn",
				"text": "<${N=Alerting;M=AcknowledgeUrl}|Acknowledge Alert>"
			}
		},
		{
			"type": "section",
			"fields": [
				{
					"type": "plain_text",
					"text": "DNS: ${N=SwisEntity;M=DNS}",
					"emoji": true
				},
				{
					"type": "plain_text",
					"text": "IP: ${N=SwisEntity;M=IP_Address}",
					"emoji": true
				},
				{
					"type": "plain_text",
					"text": "${N=SwisEntity;M=MachineType}",
					"emoji": true
				}
			]
		}
	]
}

It looks like this in slack: 

Its blurred out but the server name is a link too. I grabbed the basic data from my email alert and put it right in. Just treat the Macro's from the "Insert Variable" button in the Orion alert as the text that would be there later. I didn't have to edit it at all. 

If you are new to this, take a look at their webhook starter guide. 

Sending messages using Incoming Webhooks | Slack

Don't like writing JSON? Use the Block Kit builder. Its a terrible name for a way to use template to build out the JSON payload. 

https://api.slack.com/block-kit 

And we have the SolarWinds documentation on the alert action too:
Send a GET or POST request through HTTP or HTTPS in the Orion Platform (solarwinds.com) 

m_roberts

Great write up Jake.

I am an advocate with customers on using IM integration, even if it is an additional action to the ubiquitous email (Helpdesk integration still the preferred option), as the ability to immediately communicate within a team on an issue in the IM platform (Slack, Teams, Jabber etc.) can be hugely beneficial to getting actions organised to resolve issues reported.