Report form

The Report form alert source gives you a link to a simple web form. Anyone you hand the link to, staff, suppliers, customers, can report something that looks wrong without an account and without technical knowledge. Each report opens an alert in the source's team, with the same routing, grouping and escalation as any other source.

It covers the requirement of NIS-2 Implementing Regulation (EU) 2024/2690, Annex 3.3, that staff and relevant third parties can report incidents and suspicious events.

1. Create the sourceCopy Anchor Link

Go to Incident Management → Alert Sources → New, pick Report form, name it and choose the team. On the success screen, copy the link. It has the shape https://uptimeify.io/report/<token> (the German form: /de/report/<token>) and is shown once. If you lose it, rotate the token from the source's Settings tab; the old link keeps working for 7 days.

Share the link wherever people will find it: the intranet, the supplier portal, your security policy, an email signature.

2. What the form asksCopy Anchor Link

The page shows only your organization's name. It is not indexed by search engines and sends no referrer.

SeverityCopy Anchor Link

The severity is a suggestion from the reporter's own estimate, your team re-rates it during triage:

Every report opens its own alert (dedupKey form:<random id>), so two people reporting the same thing are two voices, not a duplicate.

Abuse protectionCopy Anchor Link

The link is public by design, so the form carries the same protection as other public forms on uptimeify.io: a hidden honeypot field, a minimum fill time, and a quota of 3 reports per sender per hour and 30 reports per form per hour. The sender's IP address is only used as a daily changing pseudonym for the quota and is not stored with the report. A discarded submission gets the same confirmation as an accepted one.

The form's link only works with the form. The webhook endpoint answers a form token with 404, and HMAC or Bearer authentication do not apply to a form source.

Personal dataCopy Anchor Link

Name and email are optional and the form says so. They stay in the alert's raw payload, which is cleared after 90 days like every other source's raw payload. The fields description, since, impact and suspectedAttack are part of the alert like any mapped field. For the reports, your organization is the controller and Uptimeify processes them on your behalf under the data processing agreement.

MappingCopy Anchor Link

A form source always has this fixed mapping; a payloadMapping sent when creating it is ignored. Test it with test-mapping by passing a payload (a form source has no sample):

{
  "title": "title",
  "severity": "severity",
  "severityMap": { "sev1": "sev1", "sev2": "sev2", "sev3": "sev3", "sev4": "sev4" },
  "dedupKey": "dedupKey",
  "custom": {
    "description": "description",
    "since": "since",
    "impact": "impact",
    "suspectedAttack": "suspectedAttack"
  }
}