feat: add Coroot eBPF APM provider (pull + webhook push)

docs/mint.json

@@ -90,7 +90,10 @@
     },
     {
       "group": "Incidents",
-      "pages": ["incidents/overview", "incidents/facets"]
+      "pages": [
+        "incidents/overview",
+        "incidents/facets"
+      ]
     },
     {
       "group": "Workflow Automation",
@@ -164,6 +167,7 @@
             "providers/documentation/clickhouse-provider",
             "providers/documentation/cloudwatch-provider",
             "providers/documentation/console-provider",
+            "providers/documentation/coroot-provider",
             "providers/documentation/coralogix-provider",
             "providers/documentation/dash0-provider",
             "providers/documentation/databend-provider",
@@ -322,14 +326,19 @@
         },
         {
           "group": "Local LLM",
-          "pages": ["deployment/local-llm/keep-with-litellm"]
+          "pages": [
+            "deployment/local-llm/keep-with-litellm"
+          ]
         },
         "deployment/stress-testing"
       ]
     },
     {
       "group": "Development",
-      "pages": ["development/getting-started", "development/external-url"]
+      "pages": [
+        "development/getting-started",
+        "development/external-url"
+      ]
     },
     {
       "group": "Keep CLI",
@@ -368,7 +377,10 @@
                 "cli/commands/workflow-runs",
                 {
                   "group": "keep workflow runs",
-                  "pages": ["cli/commands/runs-logs", "cli/commands/runs-list"]
+                  "pages": [
+                    "cli/commands/runs-logs",
+                    "cli/commands/runs-list"
+                  ]
                 }
               ]
             },
@@ -404,4 +416,4 @@
   "footerSocials": {
     "github": "https://github.com/keephq/keep"
   }
-}
+}

docs/providers/documentation/coroot-provider.mdx

@@ -0,0 +1,87 @@
+---
+title: "Coroot"
+sidebarTitle: "Coroot Provider"
+description: "Coroot provider connects Keep to Coroot's eBPF-based APM platform, enabling alert management via pull (REST API) and push (webhook) modes."
+---
+import AutoGeneratedSnippet from '/snippets/providers/coroot-snippet-autogenerated.mdx';
+
+<AutoGeneratedSnippet />
+
+## Overview
+
+[Coroot](https://coroot.com/) is an open-source eBPF-based APM and observability platform that automatically discovers service topologies, monitors application health, and detects performance anomalies without requiring code instrumentation.
+
+The Coroot provider integrates Keep with Coroot in two modes:
+
+- **Pull mode** — Keep fetches active and resolved alerts from the Coroot REST API on a schedule.
+- **Push mode (webhook)** — Coroot sends alert notifications directly to Keep as they occur.
+
+## Connecting Coroot to Keep
+
+### Pull mode (API key)
+
+1. Log in to your Coroot instance.
+2. Navigate to your project → **Settings** → **API Keys**.
+3. Click **Generate** and copy the generated API key.
+4. In Keep, configure the Coroot provider with:
+   - **Host URL** — Base URL of your Coroot instance (e.g. `https://coroot.example.com`).
+   - **Project ID** — The project slug visible in the Coroot URL (e.g. `default`).
+   - **API Key** — The key you just generated.
+
+### Push mode (webhook)
+
+1. Open your Coroot instance and navigate to the target project.
+2. Go to **Settings** → **Integrations** → **Webhooks**.
+3. Click **Add Webhook**.
+4. Set the **URL** to the Keep webhook URL shown in your provider configuration.
+5. In the **Alert template** field, enter the following JSON template:
+
+   ```
+   {{json .}}
+   ```
+
+   This sends the full alert payload as JSON to Keep.
+
+6. Click **Save**.
+
+Keep will now receive alert and recovery notifications from Coroot automatically.
+
+## Alert Mapping
+
+### Severity Mapping
+
+| Coroot Severity | Keep Severity |
+|----------------|---------------|
+| `critical`     | Critical      |
+| `warning`      | Warning       |
+| `info`         | Info          |
+| `ok`           | Low           |
+| `unknown`      | Info          |
+
+### Status Mapping (Pull mode)
+
+| Coroot State                  | Keep Status |
+|-------------------------------|-------------|
+| `resolved_at > 0`             | Resolved    |
+| `manually_resolved_at > 0`    | Resolved    |
+| `suppressed = true`           | Suppressed  |
+| All other active alerts       | Firing      |
+
+### Status Mapping (Push mode / webhook)
+
+| Coroot Status      | Keep Status |
+|--------------------|-------------|
+| `RESOLVED`, `CLOSED`, `OK` | Resolved   |
+| `SUPPRESSED`, `INHIBITED`  | Suppressed |
+| All other values   | Firing      |
+
+## Fingerprinting
+
+Keep uses the alert `id` (pull mode) or a SHA-256 hash of `project_name/application/rule_name/status` (webhook mode) for deduplication.
+
+## Useful Links
+
+- [Coroot documentation](https://coroot.com/docs/)
+- [Coroot GitHub repository](https://github.com/coroot/coroot)
+- [Coroot alerting rules](https://coroot.com/docs/coroot-community-edition/alerting/)
+- [Coroot integrations (webhooks)](https://coroot.com/docs/coroot-community-edition/alerting/integrations/)

keep/providers/coroot_provider/__init__.py

@@ -0,0 +1 @@
+from .coroot_provider import CorootProvider