Skip to main content
Upwind can send threat stories and threat detections to incident.io as alerts, so you can page the right people, route findings to the right team, and run an incident when one matters.

​
Step 1: create the alert source

  1. Go to Alerts in your incident.io dashboard and select the Sources tab.
  2. Press Create source, search for Upwind, and continue.
  3. Give it a name.
The setup page shows a Webhook URL and Bearer token. Keep it open for the next step.

​
Step 2: connect Upwind

In the Upwind Management Console:
  1. Go to Components → Integrations. Under Monitoring & Logging, find Custom Webhook and click Connect.
  2. Give the webhook a name, paste the Webhook URL from incident.io, choose Bearer Token authentication, paste the token from incident.io, and click Test & save.
  3. Go to Components → Workflows and choose Create → Create workflow.
  4. Set the trigger to either:
    • When a new threat story is created, and turn on Automatically re-send when story updated, or
    • When a new detection is found, and choose the severities you want to alert on.
  5. Add the action Send to a Custom Webhook, select the webhook you created, and click Save.
Upwind sends the story or detection object as JSON. You do not need to edit the request body. Refer to Upwind’s Custom Webhook documentation for details of their integration UI. A few things that affect how your alerts behave in incident.io:
  • Stories vs detections. A threat story groups related detections into one attack, so stories usually alert less often than individual detections. If you send both, the same attack can alert once for the story and again for each detection.
  • Supported payloads. incident.io ingests threat stories and threat detections only. Other objects Upwind can send on a Custom Webhook (configuration findings, audit logs, and similar) are rejected with an error in Recent requests.
  • Resolution. Upwind does not send webhooks when a story or detection is resolved. Alerts stay firing until someone resolves them in incident.io.

​
Step 3: check it works

Trigger the workflow from Upwind (for example by running a test detection or waiting for a real event). The alert should appear on the alert source page in incident.io within a few seconds. If nothing arrives, check Recent requests on that page. Rejected payloads are listed there with a reason, usually a workflow trigger that sends an unsupported object type.
Can’t find the alert source you are looking for? Head to our integrations page or message us at support@incident.io.