FireHydrant

FireHydrant is an incident management platform that emphasizes reliability and consistency across the entire incident response lifecycle. By integrating FireHydrant with Cortex, you can drive insights into past incidents and trigger new incidents directly from the platform.

Setup and configuration

Getting started

In order to connect Cortex to your FireHydrant instance, you’ll need to create a FireHydrant API key.

Configuration

Once you've created the API key, you can add it under API token in FireHydrant settings in Cortex. After you've pasted in the API key, click save.

Registration

See the Create services documentation for instructions on importing entities.

Entity descriptor

For a given entity, you can define FireHydrant services by ID or slug. Each of these has the same field definitions.

Field	Description	Required
identifier	Service ID or slug	✓
identifierType	Type of identifier (ID or SLUG)	✓

x-cortex-firehydrant:
  services:
    - identifier: ASDF1234
      identifierType: ID

You can find the service ID value by visiting FireHydrant → Catalog → Services. The URL for the service will also contain the ID (e.g. https://app.firehydrant.io/catalog/services//incidents).

If you prefer to use the service slug in the registration instead, you can find it on the right-hand side of the service page in FireHydrant.

x-cortex-firehydrant:
  services:
    - identifier: service-slug
      identifierType: SLUG

Expected results

Entity pages

When active incidents are detected in FireHydrant, Cortex will display incident information on an entity's details page in the Overview tab. .

On-call and incidents

Detected incidents will appear in the entity's On-call & incidents page.

Each issue will be listed with its title and description (when available). Cortex will also display the status for an issue as a badge next to its name:

• Acknowledged

• Closed

• Detected

• Identified

• Investigating

• Mitigated

• Postmortem completed

• Postmortem started

• Resolved

• Started

The issue's severity will also appear in a badge (e.g. SEV0, SEV1, SEV2).

Trigger an incident

While viewing an entity in Cortex, you can trigger an incident in FireHydrant:

1. In Cortex, navigate to an entity. On the left side of an entity details page, click On-call & incidents.

2. In the upper right side of the entity's "On-call" page, click Trigger incident.

3. Configure the incident modal:

   • Summary: Enter a title for the incident.

   • Description: Enter a description of the incident.

   • Severity: Select a severity level.

   • Condition: Nature of the incident - Unavailable, Partially Unavailable, Degraded, Bug, or Operational.

4. At the bottom of the modal, click Trigger incident.

   • A confirmation screen will appear. In the confirmation, click the link to view the incident in FireHydrant.

Scorecards and CQL

With the FireHydrant integration, you can create Scorecard rules and write CQL queries based on FireHydrant incidents.

See more examples in the CQL Explorer in Cortex.

Check if FireHydrant service is se

Check if entity has a registered FireHydrant service in its entity descriptor. If no registration exists, we'll try to automatically detect which corresponding FireHydrant service is associated with the entity.

Definition: firehydrant (==/!=) null

Example

For a Scorecard focused an production readiness, you can use this expression to make sure a FireHydrant service - and thus incident response - is defined for entities:

firehydrant != null

This is also a good way to make sure over time that FireHydrant is set up properly and reporting frequently.

Incidents

List of incidents, filterable on severity and status.

• Created at

• Description

• Impact condition name

• Name

• Severity

• Status

Definition: firehydrant.incidents()

Examples

For a Scorecard focused on service maturity or quality, you can use this expression to make sure there are no detected or identified FireHydrant incidents with a severity rating of 1 for a given entity:

firehydrant.incidents(severity = ["SEV1"], statuses = ["Detected", "Identified"]).length == 0

You can also tier severity-based rules to indicate progress over time. While the above rule might make sense in the first or second level, a higher-severity rule might make sense in a higher level:

firehydrant.incidents(severity = ["SEV3"], statuses = ["Detected", "Identified"]).length == 0

Still need help?​

The following options are available to get assistance from the Cortex Customer Engineering team:

• Email: [e-mail], or open a support ticket in the in app Resource Center

• Chat: Available in the Resource Center

• Slack: Users with a connected Slack channel will have a workflow added to their account. From here, you can either @CortexTechnicalSupport or add a :ticket: reaction to a question in Slack, and the team will respond directly.

Don’t have a Slack channel? Talk with your Customer Success Manager.