Splunk On-Call

With the VictorOps Alert integration, notifications are sent to Splunk On-Call, formerly known as VictorOps, anytime activity occurs (e.g., agent mode changes).

Adding a VictorOps Alert integration

VictorOps Alert integrations are configured per project.

  1. From the VictorOps web portal, enable integrations and copy the integration Post URL, being sure to change $routing_key to the appropriate notification group. The Post URL will be in the format of:


    For more information, check out Splunk's integration documentation.

  2. Log in to the Next-Gen WAF control panel.
  3. From the Sites menu, select a site if you have more than one site.
  4. From the Manage menu, select Site Integrations.

  5. Click Add site integration.

  6. Select the VictorOps Alert integration.

  7. In the Webhook URL field, enter the copied Post URL.

  8. Select if you want to be alerted regarding All activity or Specific activity. If you selected Specific activity, in the Activity menu choose the activity types that you want the integration to create alerts for.
  9. Click Create site integration.

Activity types

Activity typeDescription
siteDisplayNameChangedThe display name of a site was changed
siteNameChangedThe short name of a site was changed
loggingModeChangedThe agent mode ("Blocking", "Not Blocking", "Off") was changed
agentAnonModeChangedThe agent IP anonymization mode was changed
flagAn IP address was flagged
expireFlagAn IP address flag was manually expired
createCustomRedactionA custom redaction was created
removeCustomRedactionA custom redaction was removed
updateCustomRedactionA custom redaction was updated
customTagCreatedA custom signal was created
customTagUpdatedA custom signal was updated
customTagDeletedA custom signal was removed
customAlertCreatedA custom alert was created
customAlertUpdatedA custom alert was updated
customAlertDeletedA custom alert was removed
detectionCreatedA templated rule was created
detectionUpdatedA templated rule was updated
detectionDeletedA templated rule was removed
listCreatedA list was created
listUpdatedA list was updated
listDeletedA list was removed
ruleCreatedA request rule was created
ruleUpdatedA request rule was updated
ruleDeletedA request rule was deleted
customDashboardCreatedA custom dashboard was created
customDashboardUpdatedA custom dashboard was updated
customDashboardResetA custom dashboard was reset
customDashboardDeletedA custom dashboard was removed
customDashboardWidgetCreatedA custom dashboard card was created
customDashboardWidgetUpdatedA custom dashboard card was updated
customDashboardWidgetDeletedA custom dashboard card was removed
agentAlertAn agent alert was triggered
Was this guide helpful?

Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.