# Netdata

EvoHub receives Netdata Cloud notifications through the **Webhook** integration. Warning and critical alerts open EvoHub alerts and clear when Netdata sends them as cleared. Node reachability notifications open an alert when a node is unreachable and resolve it when the node is back. Netdata's webhook integration needs a paid Netdata Cloud space.

## Set it up

:::steps
### Create the integration
In EvoHub, go to **On-Call → Integrations → + Add Integration**, choose **Netdata**, pick an **Escalation Policy** and click **Create Integration**. Copy the **Webhook URL**.
### Add the webhook in Netdata
In Netdata Cloud, open **Space settings → Alerts & Notifications → + Add configuration → Webhook**. Set **Webhook URL** to your webhook URL. Keep the default authentication mechanism; EvoHub needs no Basic or Bearer credentials — the key in the URL authenticates the call. Choose the rooms and notification types.
### Send a test
Click **Test**. In EvoHub, an **info** alert called "Netdata test notification received" appears. It pages nobody, is not posted to Slack and does not count toward usage; its description holds the verification token.
### Paste the token
Copy the token into the **Verification Token** field in Netdata and save the configuration. Resolve the test alert.
:::

## What EvoHub reads

### Alert notifications

| EvoHub alert | Taken from |
| --- | --- |
| Title | "`alert` on `chart`", for example "disk_space_usage on disk_space./". |
| Description | `message`, followed by `info`. |
| Labels | `chart`, `context`, `family`, `class`, `space`, `rooms`, `host` (the node, when EvoHub finds one — see below), and `url` (the `alert_url`). |
| Fingerprint | The alert name, chart and node. |

| Netdata severity | EvoHub |
| --- | --- |
| critical | critical |
| warning | medium |
| clear | resolves the alert |

### Reachability notifications

A node becoming unreachable opens "`host` is unreachable" as **critical**. A notification with `status.reachable: true` resolves it.

## Resolve and deduplication

- An alert is identified by the alert name, the chart and the node, so the same alert on two nodes is two EvoHub alerts. Netdata's alert notification has no documented node field; EvoHub takes the node from `host` or `node` when present, else from the node in `alert_url`, else from the node the message names ("… on node db-01 …"). With none of these, the alert name and chart identify it.
- `severity: clear` resolves the open alert with the same alert name, chart and node.
- A warning that becomes critical, or repeats while open, is recorded as **Retriggered** on the same alert.

## Related

- [Integrations overview](https://docs.evohub.io/integrations-overview.md)
- [Escalation policies](https://docs.evohub.io/escalation-policies.md)