PagerDuty

The integration described in this guide uses webhooks to allow BeyondTrust to automatically send detections and recommendations to PagerDuty, which eliminates manual intervention and delays in incident response, helping organizations improve their overall security postures.

⚠️

Important

Third-party documentation is subject to change. Updates might not be reflected in BeyondTrust documentation. For the most up-to-date information, visit PagerDuty.

Requirements

Access to a BeyondTrust Identity Security Insights tenant is required, and an account with administrator privileges to create webhook integrations.

Access to PagerDuty with administrative rights to create services and add integrations.

ℹ️

Note

For more information, see PagerDuty Services and Integrations documentation.

Configure PagerDuty

1. Log in to the PagerDuty admin portal and create a service.
2. Assign an escalation policy or generate a new one.
3. Configure the alert setting to reduce noise.
4. Under the Integrations section, select Events API V2 and click Create Service.
5. Give a friendly name to this integration and make a note of the integration URL and integration key.

ℹ️

Note

For more information on the PagerDuty developer portal, see Events API v2 overview.

Create a webhook integration for PagerDuty

1. In Identity Security Insights, select your tenant.
2. In the upper left menu, click Insights > Integrations.
   The Integrations page displays the available integrations.
3. Click Webhooks or your product.
   The Summary page displays.
4. Click Create Integration.
   The Configure Integration page displays.
5. To create the webhook, use the following:
   • Webhook Name: Enter a name
   • Webhook URL: Enter the integration URL noted in Configure PagerDuty
   • Authorization Type: Bearer
   • Token: Enter the integration keynoted in Configure PagerDuty
   • Webhook template: Use the following test webhook JSON template to test the connection and send a webhook to PagerDuty. After a successful test with the static test data, the template can be configured. Create or change the fields and add variables as per your requirements.

{
    "id": "%%incidentId%%",
    "object": "event",
    "creation_time": "%%timestamp%%",
    "type": "PagerDuty Incident",
    "api_version": "v1",
    "data":{
        "summary": "%%definitionSummary%%",
        "severity": "%%severity%%",
        "source": "%%source%%",
        "assignment_group": "YOUR PAGERDUTY ASSIGNMENT GROUP",
        "caller_id": " YOUR PAGERDUTY CALLER ID ",
        "impact": "1",
        "urgency": "2",
        "tenantId":  "%%tenantId%%",
        "incidentType": "%%incidentType%%",
        "definitionId": "%%definitionId%%",
        "location": "%%location%%",
        "entityType": "%%entityType%%",
        "entityName":"%%entityName%%",
        "link": "%%link%%"
    }
}