LibreNMS now has a native
Flowtriq alert transport

Back to Blog

What Happened

We submitted a pull request to LibreNMS adding Flowtriq as a native alert transport. It was reviewed and merged on July 20, 2026. Flowtriq now appears alongside Slack, PagerDuty, Telegram, and the other 40+ transports that LibreNMS supports out of the box.

This means you can forward LibreNMS alerts to Flowtriq without writing scripts, parsing syslog, or setting up a generic webhook relay. You select "Flowtriq" from the transport list, enter your webhook URL and optional API key, and it works.

How to Set It Up

In your LibreNMS web interface:

1. Navigate to Alerts > Alert Transports.
2. Click Create alert transport.
3. Set the transport type to Flowtriq.
4. Enter your Webhook URL (your Flowtriq instance's inbound webhook endpoint).
5. Optionally enter your API Key for authentication.
6. Save the transport and assign it to your alert rules.

The transport sends a structured JSON payload on every alert trigger. The payload includes the alert source, current status, severity level, device hostname, sysName, hardware model, OS, and the full alert message. Flowtriq's inbound webhook auto-detects the LibreNMS format and normalizes it into its standard event timeline.

What Gets Forwarded

The transport forwards every field that is useful for correlating infrastructure events with DDoS activity:

Field	Description
source	Always librenms
status	Alert status: alert, acknowledged, or recovered
severity	Alert severity level from the LibreNMS rule
hostname	Device hostname that triggered the alert
sysName	SNMP sysName of the device
hardware	Hardware model string
message	Full alert message with context

Authentication is optional but recommended. When you provide an API key, the transport sends it as an X-API-Key header. Flowtriq validates the key against your account before processing the payload.

Why This Matters

LibreNMS is one of the most widely deployed open-source NMS platforms, used by ISPs, hosting providers, and enterprise networks for SNMP-based device monitoring. It tracks interface utilization, BGP session state, hardware health, and hundreds of other device metrics.

When a DDoS attack hits your network, the symptoms show up in both systems. LibreNMS sees interface utilization spike, BGP sessions flap, and device CPU climb. Flowtriq sees the actual attack traffic at the packet level and classifies the vector. Without correlation, your NOC team is looking at two separate dashboards trying to piece together whether the interface saturation on router-edge-01 is related to the UDP flood that Flowtriq detected on 198.51.100.0/24.

With the alert transport, LibreNMS events land on the same Flowtriq timeline as detected attacks. The correlation becomes immediate: the interface utilization alert and the DDoS detection event appear together, timestamped and linked to the same device. Your team can see the full picture without context-switching.

LibreNMS polls via SNMP at 60-300 second intervals. Flowtriq detects at 1-second granularity via packet analysis. The two systems see the same attack at different timescales, which is exactly why correlating them is useful.

The Contribution

The PR added two files to the LibreNMS codebase:

• LibreNMS/Alert/Transport/Flowtriq.php - The transport class that handles payload construction and HTTP delivery
• doc/Alerting/Transports/Flowtriq.md - Documentation for the transport configuration

The implementation follows LibreNMS's standard transport pattern. The transport class extends the base Transport class, defines the configuration fields (webhook URL and API key), and implements the deliverAlert method that constructs the JSON payload and sends it via HTTP POST. It fits naturally alongside the existing Slack, PagerDuty, and Mattermost transports.

Back to Blog

Related Articles