# Grafana

EvoHub receives alerts from Grafana Alerting through a **Webhook** contact point. Each firing alert opens an EvoHub alert, and Grafana's resolved notification resolves it.

## Set it up

:::steps
### Create the integration
In EvoHub, go to **On-Call → Integrations → + Add Integration**, choose **Grafana**, pick an **Escalation Policy** and click **Create Integration**. Copy the **Webhook URL**.
### Add a contact point in Grafana
In Grafana Alerting, open **Contact points** (under **Notification configuration** in recent versions) and click **+ Add contact point**. Choose the **Webhook** integration, paste the URL into **URL** and set **HTTP Method** to **POST**. Save.
### Use it in a notification policy
In Grafana Alerting's **Notification policies**, send the alerts that should page to the new contact point — as the default policy or a nested policy matching specific labels.
:::

Grafana sends resolved notifications by default, so auto-resolve works without extra settings (unless you turned on **Disable resolved message** on the contact point).

You can use Grafana's **Test** button on the contact point to check the connection; it sends a firing test notification that EvoHub treats like any other alert: it opens an alert under the integration's escalation policy, so it pages, and you resolve it in EvoHub.

## What EvoHub reads

Grafana can send several alerts in one notification. EvoHub handles each alert separately:

| EvoHub alert | Taken from |
| --- | --- |
| Title | The alert's `alertname` label, otherwise the notification title. |
| Description | The `summary` annotation, otherwise the `description` annotation, otherwise the notification message. |
| Severity | The `severity` label — see below. |
| Labels and annotations | All of the alert's labels and annotations. |
| Links | The rule (`url`), and the dashboard, panel, silence and screenshot links when Grafana sends them (`dashboard_url`, `panel_url`, `silence_url`, `image_url`). They open from the alert. |
| Values | What crossed the threshold, as `values` (for example `A=97.2, B=1`). |
| Fingerprint | Grafana's fingerprint for the alert (or one computed from its labels). |

### Severity

Add a `severity` label to your Grafana alert rules to control urgency:

| `severity` label | EvoHub severity |
| --- | --- |
| `critical`, `page`, `emergency`, `fatal`, `p1` | critical |
| `high`, `error`, `major`, `warning`, `p2` | high |
| `low`, `minor`, `p4` | low |
| `info`, `informational`, `none`, `p5` | info |
| anything else (including `medium`), or missing | medium |

## Resolve and deduplication

- A `firing` alert opens an EvoHub alert. Repeat notifications for an alert that is still open are recorded as **Retriggered**, and nobody is paged again.
- A `resolved` alert resolves the matching EvoHub alert.
- Alerts with different label sets are different alerts. A multi-dimensional rule (for example one alert per host) opens one EvoHub alert per host.

## Troubleshooting

- **Contact point test fails with 401**: the key in the URL is wrong, or the integration is disabled in EvoHub.
- **Alerts never resolve**: check that resolved messages are not disabled on the contact point.
- **Alert arrives but nobody is paged**: check the integration's escalation policy and who is on call.

## Related

- [Integrations overview](https://docs.evohub.io/integrations-overview.md)
- [Prometheus](https://docs.evohub.io/prometheus-alertmanager.md)
- [Escalation policies](https://docs.evohub.io/escalation-policies.md)