> ## Documentation Index
> Fetch the complete documentation index at: https://docs.incident.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Adding Upwind as an Alert Source

> Send Upwind threat stories and threat detections into incident.io as alerts

Upwind can send **threat stories** and **threat detections** to incident.io as alerts, so you
can page the right people, route findings to the right team, and run an incident when one
matters.

## Step 1: create the alert source

1. Go to [Alerts](https://app.incident.io/~/on-call/alert-routes/sources) in your incident.io dashboard
   and select the **Sources** tab.
2. Press **Create source**, search for **Upwind**, and continue.
3. Give it a name.

The setup page shows a **Webhook URL** and **Bearer token**. Keep it open for the next step.

## Step 2: connect Upwind

In the [Upwind Management Console](https://console.upwind.io):

1. Go to **Components → Integrations**. Under **Monitoring & Logging**, find **Custom
   Webhook** and click **Connect**.
2. Give the webhook a name, paste the **Webhook URL** from incident.io, choose **Bearer
   Token** authentication, paste the token from incident.io, and click **Test & save**.
3. Go to **Components → Workflows** and choose **Create → Create workflow**.
4. Set the trigger to either:
   * **When a new threat story is created**, and turn on **Automatically re-send when story
     updated**, or
   * **When a new detection is found**, and choose the severities you want to alert on.
5. Add the action **Send to a Custom Webhook**, select the webhook you created, and click
   **Save**.

Upwind sends the story or detection object as JSON. You do not need to edit the request body.

Refer to [Upwind's Custom Webhook documentation](https://docs.upwind.io/integrations/monitoring-and-logging/custom-webhook)
for details of their integration UI.

A few things that affect how your alerts behave in incident.io:

* **Stories vs detections.** A threat story groups related detections into one attack, so
  stories usually alert less often than individual detections. If you send both, the same
  attack can alert once for the story and again for each detection.
* **Supported payloads.** incident.io ingests **threat stories** and **threat detections**
  only. Other objects Upwind can send on a Custom Webhook (configuration findings, audit
  logs, and similar) are rejected with an error in **Recent requests**.
* **Resolution.** Upwind does not send webhooks when a story or detection is resolved. Alerts
  stay **firing** until someone resolves them in incident.io.

## Step 3: check it works

Trigger the workflow from Upwind (for example by running a test detection or waiting for a
real event). The alert should appear on the alert source page in incident.io within a few
seconds.

If nothing arrives, check **Recent requests** on that page. Rejected payloads are listed
there with a reason, usually a workflow trigger that sends an unsupported object type.

***

Can't find the alert source you are looking for? Head to our
[integrations page](https://incident.io/integrations) or message us at
[support@incident.io](mailto:support@incident.io).