Skip to main content



FireHydrant is an incident management platform that emphasizes reliability and consistency across the entire incident response lifecycle. By integrating FireHydrant with Cortex, you can drive insights into past incidents and trigger new ones directly from the platform.

Setup and configuration

Getting started

In order to connect Cortex to your FireHydrant instance, you’ll need to create a FireHydrant API key.


Once you've created the API key, you can add it under API token in FireHydrant settings in Cortex. After you've pasted in the API key, click save.


If you do not see the settings page you're looking for, you likely don't have the proper permissions and need to contact your admin.

If you’ve set everything up correctly, you’ll see the option to Remove Integration in settings.

You can also use the Test configuration button to confirm that the configuration was successful. If your configuration is valid, you’ll see a banner that says “Configuration is valid. If you see issues, please see documentation or reach out to Cortex support.”



By default, Cortex will use the entity tag (e.g. my-entity) as the "best guess" for the FireHydrant service. For example, if your entity tag is my-entity, then the corresponding service in FireHydrant should also be my-entity.

If your FireHydrant services don’t cleanly match the Cortex entity tag, you can override this in the Cortex entity descriptor.

Entity descriptor

For a given entity, you can define FireHydrant services by ID or slug. Each of these has the same field definitions.

identifierService ID or slug
typeType of identifier (ID or SLUG)
- identifier: ASDF1234
type: ID

You can find the service ID value by visiting FireHydrant → Catalog → Services. The URL for the service will also contain the ID (e.g.<ID>/incidents).

If you prefer to use the service slug in the registration instead, you can find it on the right-hand side of the service page in FireHydrant.

- identifier: service-slug
type: SLUG

Expected results

Entity pages

When active incidents are detected in FireHydrant, Cortex will display incident information on an entity's details page in the Overview and Operations tabs.

Integrations - FireHydrant

Detected incidents will also populate on the FireHydrant page under Integrations.

Each issue will be listed with its title and description (when available). Cortex will also display the status for an issue as a badge next to its name:

  • Acknowledged
  • Closed
  • Detected
  • Identified
  • Investigating
  • Mitigated
  • Postmortem completed
  • Postmortem started
  • Resolved
  • Started

The issue's severity will also appear in a badge (e.g. SEV0, SEV1, SEV2).

Triggering incidents

You can also trigger an incident via the Trigger incident button from the FireHydrant page under Integrations.

This will open a modal where you can enter information about the incident:

  • Name: Name for the incident.
  • Summary: Summary of the incident.
  • Description: Long-form description of the incident.
  • Severity: Severity of the issue; dropdown options will depend on severities set in your FireHydrant instance.
  • Condition: Nature of the incident - Unavailable, Partially Unavailable, Degraded, Bug, or Operational.

Once you click Trigger incident in the modal, Cortex will initiate the incident process for the relevant service in FireHydrant.

Scorecards and CQL

With the FireHydrant integration, you can create Scorecard rules and write CQL queries based on FireHydrant incidents.

Check if FireHydrant service is set

Check if entity has a registered FireHydrant service in its entity descriptor. If no registration exists, we'll try to automatically detect which corresponding FireHydrant service is associated with the entity.

Definition: firehydrant (==/!=) null


For a Scorecard focused an production readiness, you can use this expression to make sure a FireHydrant service - and thus incident response - is defined for entities:

firehydrant != null

This is also a good way to make sure over time that FireHydrant is set up properly and reporting frequently.


List of incidents, filterable on severity and status.

  • Created at

  • Description

  • Impact condition name

  • Name

  • Severity

  • Status

    Definition: firehydrant.incidents()


For a Scorecard focused on service maturity or quality, you can use this expression to make sure there are no detected or identified FireHydrant incidents with a severity rating of 1 for a given entity:

firehydrant.incidents(severity = ["SEV1"], statuses = ["Detected", "Identified"]).length == 0

You can also tier severity-based rules to indicate progress over time. While the above rule might make sense in the first or second level, a higher-severity rule might make sense in a higher level:

firehydrant.incidents(severity = ["SEV3"], statuses = ["Detected", "Identified"]).length == 0

Still need help?

The following are all the ways to get assistance from our customer engineering team. Please use the option that is best for your users:

  • Email:, or open a support ticket in the in app Resource Center
  • Chat: Available in the Resource Center
  • Slack: Users with a connected Slack channel will have a workflow added to their account. From here, you can either @CortexTechnicalSupport or add a :ticket: reaction to a question in Slack, and the team will respond directly.

Don’t have a Slack channel? Talk with your customer success manager.