Skip to content
Olympusx AIOlympusx AIOlympusx AI documentation

Alert integration

Each log source can take alerts. Your Alertmanager, or any SIEM that can post JSON, sends an alert to the source’s webhook with its secret as a bearer token, and Olympusx AI opens an investigation of that source around the alert’s time, with the model you chose for alerts. Each firing opens one investigation, once. Admins turn alerts on; auditors see whether they are on and when the last alert came.

Turn alerts on

Section titled “Turn alerts on”
  1. Open Use cases › Security and select the Sources tab.
  2. Under Log sources, select Alerts on the source’s row.
  3. Choose the Model that investigates alerts and select Turn on.
  4. Copy what the dialog shows now. The secret is shown only here; if it is lost, select Replace the secret.

The dialog shows an Alertmanager receiver, ready to paste:

receivers:
  - name: olympus
    webhook_configs:
      - url: https://<console-host>/api/v1/hooks/log-sources/<source-id>
        http_config:
          authorization:
            credentials: <secret>

The row then reads Alerts: on. Opening Alerts again shows On. The last alert came when, or On, but no alert has come yet.

Configure Alertmanager

Section titled “Configure Alertmanager”

  1. Add the receiver above to your Alertmanager configuration. authorization with no type sends Authorization: Bearer <secret>.

  2. Route the alerts you want investigated to it, for example:

    route:
      routes:
        - receiver: olympus
          matchers:
            - team = "network"
          continue: true

  3. Reload Alertmanager.

Olympusx AI reads Alertmanager’s webhook body. It opens investigations only for alerts whose status is firing; resolved alerts are acknowledged and ignored, so send_resolved may stay on. Each alert’s labels.alertname, annotations.summary, annotations.description and other labels become the investigation’s question, quoted as data. Its startsAt is the alert’s time, and its fingerprint (or its labels) tells a repeat from a new firing.

Post from another SIEM

Section titled “Post from another SIEM”

Post one alert as JSON to the same address with the same bearer token:

curl -X POST 'https://<console-host>/api/v1/hooks/log-sources/<source-id>' \
  -H 'Authorization: Bearer <secret>' \
  -H 'Content-Type: application/json' \
  -d '{"title":"Port scan from 10.0.4.17","description":"More than 500 ports probed in 2 minutes","time":"2026-11-02T08:14:00Z","id":"rule-4411-10.0.4.17"}'
Field Required Meaning
title Yes The alert’s name.
description No What the rule saw.
time No When it fired, in RFC 3339. Missing or in the future, the time of delivery is used.
id No Your alert’s identifier. Without one, the title and description identify it.

What an alert opens

Section titled “What an alert opens”
  • The window: from 2 hours before the alert’s time to 30 minutes after it, or to now if that is sooner.
  • The question: “An alert fired at time: name. Its summary: summary. Labels: labels. What happened around it, and is it a real threat?”
  • The investigation: an ordinary investigation of that log source, with the same rounds and limits, listed on the Investigations tab tagged Alert. When its verdict is suspicious or malicious, it may draft a Sigma rule; see Exports.

A firing is opened once. Delivering the same alert with the same start time again is answered as a repeat and opens nothing.

Responses

Section titled “Responses”
Status Meaning
202 Investigations opened. The body lists their ids under investigations and counts repeats under repeated.
200 Nothing new opened: every alert was a repeat or resolved, or the model’s budget is spent.
400 not_an_alert The body is neither an Alertmanager webhook nor {title, ...}.
401 bad_token The bearer token is not this source’s secret.
404 No such source, or its alerts are off.
409 model_unavailable The model chosen for alerts may no longer be used. Turn alerts on again with another model.
413 The body is larger than 1 MiB.

Turn alerts off

Section titled “Turn alerts off”

Open Alerts on the source and select Turn alerts off. Deliveries are then answered 404. Investigations already opened are kept.

Limits

Section titled “Limits”
Limit Value
Alerts one delivery opens 5. Alerts past the fifth in one delivery are not investigated; route or group so a delivery carries few alerts.
Window 2 hours before the alert to 30 minutes after
Delivery body 1 MiB
Alert name in the question 200 characters
Summary in the question 600 characters
Labels in the question 400 characters, each value 80
Section titled “Related”