Graylog Integration

Connect Graylog to ITOC360 so that every alert your event definitions produce lands directly in your on-call workflow — no manual forwarding, no missed pages.

Overview

Graylog is an open-source log management and SIEM platform that lets you define conditions on your log data and fire notifications when those conditions are met. The HTTP Notification type sends a structured JSON payload to any endpoint you point it at, which is exactly how ITOC360 receives it.

When a Graylog event definition matches, ITOC360 opens an alert. Repeated firings of the same definition group into that existing alert rather than creating duplicates, so a flapping condition produces one alert to act on instead of a stream of pages. Graylog does not send a follow-up notification when a condition stops matching, so alerts raised from Graylog are closed in ITOC360 by the responder once the issue is handled.

The screenshot below shows the Alerts & Events dashboard where your event history and alert metrics are visible at a glance.

---

Step 1 — Open the Notifications Page

In the top navigation bar, click Alerts, then select the Notifications tab. This is where you manage every outbound integration Graylog can call.

Click Create Notification in the top-right corner to start.

Step 2 — Whitelist the ITOC360 URL

Graylog validates every outbound notification URL against an allowlist and silently refuses to POST to addresses that are not on it. Configure this before creating the notification, otherwise the notification will appear to save correctly but never deliver.

Go to System → Configurations, find URL Whitelist, and click Edit configuration. Add an entry:

• Title — itoc360

• Type — Regex

• Value — ^https://api\.itoc360\.app/.*

Step 3— Configure the HTTP Notification

Fill in the form that appears:

• Title — give it a name you'll recognise later, for example ITOC360

• Notification Type — select HTTP Notification from the dropdown

• URL — paste https://api.itoc360.app/functions/v1/events?token=<x-itoc360-token> URL here, including the token query parameter

The form also has optional fields for Basic Authentication, API Key, and API Secret. You do not need any of these — ITOC360 authenticates through the token in the URL.

Once the URL is in place, click Execute Test Notification to fire a test payload immediately. If everything is wired up correctly, a new alert will appear in your ITOC360 source within a few seconds.

Scroll down and click Save to store the notification.

Step 4 — Attach the Notification to an Event Definition

A notification on its own does nothing until it is linked to an event definition. Open Event Definitions, find the definition you want to forward to ITOC360, and click Edit. Navigate to the Notifications step, click Add Notification, and select the ITOC360 notification you just created. Save the definition.

On the same Notifications step, set Message Backlog to a non-zero value such as 5. With a backlog of 0 the alert still arrives, but it carries only the event definition title and no log content — rarely enough for a responder to act on.

From this point on, every time that event definition triggers, Graylog will POST the payload to ITOC360.

How Alerts Map to Incidents

How Alerts Are Grouped

ITOC360 identifies a Graylog alert by its event definition, so every firing of the same definition lands on the same alert instead of opening a new one. If the definition uses an aggregation with a group-by field, each group is tracked as a separate alert.

The log lines that triggered the condition are read from the backlog array and attached to the alert. Two fields in the payload are easy to misread: event.message repeats the event definition title rather than carrying the log line, and event.source identifies the Graylog node rather than the monitored host. Both the log line and its originating host come from backlog.

Priority Mapping

ITOC360 uses the event.priority integer that Graylog includes in every payload:

Graylog event.priority	ITOC360 Priority
1	Low
2	Medium
3	High

You can override these defaults per source under Sources → Edit → Priority Mapping.

Troubleshooting

Execute Test Notification returns an error or no alert appears

Check that the URL in the notification form is exactly the one shown on your ITOC360 source page, token included. A single mistyped character will cause a 401 or 404. If the test reports success but no alert appears, check the URL whitelist in System → Configurations — an address that is not whitelisted is rejected without an error in the notification form.

Alerts do not close by themselves

This is expected. Graylog sends a notification when a condition is met and does not send one when it clears, so there is no resolution signal for ITOC360 to act on. Close the alert in ITOC360 once the underlying issue is handled. If you need automatic closure, route Graylog through n8n and send an explicit resolve event from a second event definition that matches the healthy state.

Unknown or placeholder values in the payload

Fields like job_definition_id: "<unknown>" and event.id: "TEST_NOTIFICATION_ID" appear only when you use the Execute Test Notification button. In production, when a real event triggers the definition, all fields will contain the actual Graylog-generated values.