> ## Documentation Index
> Fetch the complete documentation index at: https://docs.warrn.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Coralogix

> Receive alerts from Coralogix via generic outbound webhook.

| Property         | Value    |
| ---------------- | -------- |
| **Type**         | Incoming |
| **Level**        | Service  |
| **Auto-resolve** | Yes      |

Coralogix sends alert notifications to Warrn via a generic outbound webhook. When an alert triggers, Warrn creates an alert. When Coralogix sends a resolve action, Warrn auto-resolves the matching alert.

## Setup

<Steps>
  <Step title="Add the integration in Warrn">
    Open a service or team in Warrn. Go to the **Integrations** tab, add **Coralogix**,. Copy the generated webhook URL.
  </Step>

  <Step title="Create an outbound webhook in Coralogix">
    In Coralogix, go to **Data Flow > Outbound Webhooks**. Click **Add New** and select **Generic Webhook**. Paste the webhook URL from Warrn and save.
  </Step>

  <Step title="Assign the webhook to alert definitions">
    In Coralogix, open your alert definitions and select the webhook you created as the notification channel. Enable **Notify When Resolved** on each alert for auto-resolve support.
  </Step>
</Steps>

## How it works

Coralogix sends a JSON payload with an `alert_action` field:

* **trigger**: Creates a new alert in Warrn. Deduplicates by `alert_id`.
* **resolve**: Auto-resolves the matching Warrn alert.

Coralogix payloads include a `fields` array with key-value pairs for severity, priority, application, subsystem, team, and other metadata.

### Field mapping

| Coralogix field                                                         | Warrn field                                   |
| ----------------------------------------------------------------------- | --------------------------------------------- |
| `name` (with application context)                                       | Alert name                                    |
| `description`, application, subsystem, team, threshold, hit count, URLs | Description                                   |
| `fields[severity]` or `fields[priority]`                                | Severity (mapped, see below)                  |
| `alert_id`                                                              | Alert alias (used for dedup and auto-resolve) |
| Application, subsystem, team, service, group-by labels                  | Tags                                          |

## Severity mapping

Warrn checks the `severity` field first, then falls back to `priority`:

| Coralogix severity | Warrn severity |
| ------------------ | -------------- |
| `critical`         | critical       |
| `error`            | high           |
| `warning`          | medium         |
| `info`             | low            |
| `verbose`          | low            |
| `debug`            | low            |

| Coralogix priority        | Warrn severity |
| ------------------------- | -------------- |
| `P1`                      | critical       |
| `P2`                      | high           |
| `P3`                      | medium         |
| `P4`                      | low            |
| `P5`                      | low            |
| (missing or unrecognized) | medium         |