Set up Zabbix alerts in ITSI

Set up an integration with Zabbix and send alerts from Zabbix to ITSI.

Prerequisites

  • You must have Zabbix version 6.0 or later installed.

  • You must be an admin for Zabbix.

  • Create a HEC endpoint and token to set up the webhook.

Overview

Zabbix uses Media types to define notification channels. The Webhook media type allows running a JavaScript snippet on each alert, which sends event data to Splunk HEC. This media type is attached to a user, creating an action to trigger the webhook when a Zabbix alert is sent. The same

Configure Zabbix webhook

  1. Log in to Zabbix.

  2. Navigate to Alerts then Media types, or Administration then Media types.

  3. Select Create media type.

  4. Set the Type to Webhook.

  5. Fill in the following fields:

    1. Name: Splunk HEC

    2. Type: Webhook

  6. In the Parameters section, add key-value pairs passed as a JSON object to the script. Replace placeholders with your HEC URL and token:

    Name Value
    alert_message {ALERT.MESSAGE}
    alert_subject {ALERT.SUBJECT}
    event_date {EVENT.DATE}
    event_id {EVENT.ID}
    event_name {EVENT.NAME}
    event_recovery_date {EVENT.RECOVERY.DATE}
    event_recovery_time {EVENT.RECOVERY.TIME}
    event_severity {EVENT.SEVERITY}
    event_source {EVENT.SOURCE}
    event_tags {EVENT.TAGS}
    event_time {EVENT.TIME}
    event_update_action {EVENT.UPDATE.ACTION}
    event_update_date {EVENT.UPDATE.DATE}
    event_update_message {EVENT.UPDATE.MESSAGE}
    event_update_status {EVENT.UPDATE.STATUS}
    event_update_time {EVENT.UPDATE.TIME}
    event_update_user {EVENT.UPDATE.USER}
    event_value {EVENT.VALUE}
    host_ip {HOST.IP}
    host_name {HOST.NAME}
    TOKEN <your-hec-token>
    trigger_description {TRIGGER.DESCRIPTION}
    trigger_id {TRIGGER.ID}
    URL https://<splunk-host>:8088/services/collector
    Note: {EVENT.VALUE} is 1 for a problem and 0 for a recovery. {EVENT.SOURCE} indicates whether the alert came from a trigger, discovery rule, or other source.
  7. In the Script tab, paste the following JavaScript:
    JSON 
    try {
    var params = JSON.parse(value);
    if (!params.URL || !params.TOKEN) {
        throw 'Missing required parameters URL or TOKEN';
    }
    var req = new HttpRequest();
    req.addHeader('Authorization: Splunk ' + params.TOKEN);
    req.addHeader('Content-Type: application/json');
    var data = JSON.stringify({
        event: params,
        sourcetype: 'zabbix:alert'
    });
    var response = req.post(params.URL, data);
    if (req.getStatus() != 200) {
        throw 'Failed to send data to Splunk HEC: ' + req.getStatus() + ' Response: ' + response;
    }
    return 'OK';
} catch (error) {
    Zabbix.log(4, '[ Splunk HEC Webhook ] Error: ' + error);
    throw 'Splunk HEC Webhook failed: ' + error;
}
    When an alert is triggered, Zabbix bundles your defined parameters into a structured JSON string, which the script then unpacks into a readable object for processing. This object is forwarded through the HTTP Event Collector (HEC) with the sourcetype set to zabbix:alert, ensuring your data is correctly categorized.

Create an action

  1. Navigate to Alerts then Actions then Trigger actions.

  2. Select Create action.

  3. On the Action tab:

    1. Set Name to Send alerts to Splunk

    2. Set any Conditions you want (e.g., filter by host group, minimum severity). Leave conditions empty to catch all triggers.

  4. On the Operations tab, select Add.
  5. Under Operations:
    1. Set Operation type to Send message
    2. Send to users: Select the user from Step 2.
    3. Set Send only to: Splunk HEC
  6. (Optional) Add a Recovery operations entry so Splunk receives a recovery event when the problem is resolved.
  7. Select Add to save the action.

Test Zabbix alert

On the Media types list page, select Test for the Splunk HEC. Verify that a test event appears in Splunk. The following example displays a sample event:
JSON 
{
  "alert_message": "High CPU utilization detected on webserver01.example.com. Current usage: 95.5%",
  "alert_subject": "Problem: High CPU on webserver01.example.com",
  "event_date": "2025.10.03",
  "event_id": "1234567890123456789",
  "event_name": "CPU utilization is too high ( > 90% for 5m )",
  "event_recovery_date": "",
  "event_recovery_time": "",
  "event_severity": "High",
  "event_source": "Trigger",
  "event_tags": "application:web,environment:production",
  "event_time": "10:30:00",
  "event_update_action": "",
  "event_update_date": "",
  "event_update_message": "",
  "event_update_status": "",
  "event_update_time": "",
  "event_update_user": "",
  "event_value": "1",
  "host_ip": "192.168.1.100",
  "host_name": "webserver01.example.com",
  "trigger_description": "Checks if the average CPU utilization over the last 5 minutes exceeds 90%.",
  "trigger_id": "9876543210987654321"
}