Rootly

Rootly is an on-call and incident response platform.

Integrating Rootly with Cortex allows you to:

• Trigger an incident directly from Cortex
• View incident data on entity pages in Cortex
  • When active incidents are detected in Rootly, Cortex will display incident information on an entity's details page in the Overview and Operations tabs.
• Create Scorecards that track progress and drive alignment on projects involving incidents

How to configure Rootly with Cortex

Prerequisites

Before getting started:

• Create an API token in Rootly. Ensure the Rootly user account represented by the API key has admin permissions in Rootly.

Configure the integration in Cortex

1. In Cortex, navigate to the Rootly settings page:
   1. In Cortex, click your avatar in the lower left corner, then click Settings.
   2. Under "Integrations," click Rootly.
2. Click Add Rootly configuration.
3. Configure the Rootly integration form:
   • Account alias: Enter the alias for your configuration.
   • API token: Enter your Rootly API token.
4. Click Save.

caution

If you do not see the settings page you're looking for, you may not have permission to access that page. Please contact your admin for assistance.

Once you save your configuration, you'll see it listed on the integration's settings page in Cortex. If you’ve set everything up correctly, you’ll see the option to Remove Integration in Settings.

You can also use the Test all configurations button to confirm that the configuration was successful. If your configuration is valid, you’ll see a banner that says “Configuration is valid. If you see issues, please see documentation or reach out to Cortex support.”

Configure the integration for multiple Rootly accounts

The Rootly integration has multi-account support. You can add a configuration for each additional instance by repeating the process above.

Each configuration requires an alias, which Cortex uses to correlate the designated instance with registrations for various entities. Registrations can also use a default configuration without a listed alias. You can edit aliases and default configurations from the Rootly page in your Cortex settings. Select the edit icon next to a given configuration and toggle Set as default on. If you only have one configuration, it will automatically be set as the default.

Viewing incidents in Cortex

You can view incidents on an entity details page. Each incident is listed with its title, severity, status, and description.

To view the list of incidents:

1. In Cortex, navigate to an entity.
2. On the left side of the entity details page, click Integrations > Rootly.
3. In the list, view all incidents from the last 30 days. To narrow the list by severity or or status, use the filters at the top of the page.

In addition, you can see incident information at a glance under the Overview and Operations tabs of an entity details page.

How to connect Cortex entities to Rootly

Discovery

By default, Cortex will use the entity tag (e.g. my-entity) or entity name as the "best-guess" for a Rootly service. For example, if your entity tag is my-entity, then the corresponding service slug in Rootly should also be my-entity.

If your Rootly service name does not match the Cortex entity tag or name, you can override this in the Cortex entity descriptor.

Editing the entity descriptor

For a given entity, you can define Rootly services by ID or slug.

Field	Description	Required
id	Service ID	****
slug	Service slug	****

Service ID

x-cortex-rootly:
  services:
    - id: ASDF1234

Service slug

x-cortex-rootly:
  services:
    - slug: service-slug

Trigger an incident

While viewing an entity in Cortex, you can trigger an incident in Rootly:

1. In Cortex, navigate to an entity. On the left side of an entity details page, click Integrations > Rootly.
2. In the upper right side of the entity's Rootly page, click Trigger incident.
3. Configure the incident modal:
   • Name: Enter a name for the incident.
   • Summary: Enter a summary for the incident.
   • Description: Enter a long-form description of the incident.
   • Severity: Select a severity level.
   • Condition: Select a condition for the incident.
4. At the bottom of the modal, click Trigger incident.
   • A confirmation screen will appear. In the confirmation, click the link to view the incident in Rootly.

Scorecards and CQL

With the Rootly integration, you can create Scorecard rules and write CQL queries based on Rootly incidents.

See more examples in the CQL Explorer in Cortex.

Check if Rootly service is set

Check if entity has a registered Rootly service in its entity descriptor.

If no registration exists, Cortex will try to automatically detect which corresponding Rootly service name or tag is associated with the entity.

Definition: rootly (==/!=) null

Example

For a Scorecard focused on operational maturity, you can use this expression to make sure each entity has an Rootly service set:

rootly != null

Incidents

List incidents, filterable by severity and status.

• Created at

• Mode

• Name

• Severity

• Status

• Summary

• Type

• URL

  Definition: rootly.incidents()

Examples

To assess entities' health in a Scorecard, you can write a rule to make sure a given entity has fewer than three incidents with a severity of SEV1:

rootly.incidents(severity = ["SEV1"]).length < 3

You can also use this expression to query for entities that have two or fewer critical incidents in the last three months:

  rootly.incidents(severity = ["Critical"]).filter((incident) => incident.createdAt.fromNow() > duration("-P90D")).length <= 2

Still need help?

The following are all the ways to get assistance from our customer engineering team. Please use the option that is best for your users:

• Email: help@cortex.io, or open a support ticket in the in app Resource Center
• Chat: Available in the Resource Center
• Slack: Users with a connected Slack channel will have a workflow added to their account. From here, you can either @CortexTechnicalSupport or add a :ticket: reaction to a question in Slack, and the team will respond directly.

Don’t have a Slack channel? Talk with your customer success manager.