PagerDuty webhook connections allow you to send alert results as a PagerDuty notification. You can learn more about PagerDuty webhooks.
Configuration
- In the Configuration Box, enter the Configuration Name to uniquely identify this configuration.
- Identify the content of headers and payload that you need to provide in the Configuration Box.
Below is an example on how you can leverage this integration to send alert events to PagerDuty.
Payload
{
"routing_key": "[SERVICE KEY]",
"event_action": "trigger",
"description": "Alert from DNIF - Found Suspicious Remote Desktop Activity on host $DstIP",
"client": "DNIF",
"payload": {
"summary": "summary",
"source": "Monitor Name",
"severity": "info"
}
}
PagerDuty Alert Event, sends an alert to the PagerDuty account based on the values given in the payload.
In the above figure, a workbook named Suspicious Remote Desktop Network Activity is executed which contains the following blocks:
- SQL Block: Displays two suspicious Destination IPs on execution of the workbook
- Signal Block: This will raise a signal on detecting the suspicious IPs.
- DQL block with _trigger query: Using Webhook integration for PagerDuty, an alert will be sent to the PagerDuty account.