PagerDuty v2

Alert and notify users using PagerDuty.

Messaging and Conferencing · PagerDuty

Details

ID	`PagerDuty v2`
Provider	PagerDuty
Category	Messaging and Conferencing
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Use the PagerDuty integration to manage schedules and on-call users.
This integration was integrated and tested with PagerDuty API v2.

Configure PagerDuty v2 on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for PagerDuty v2.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
API Key		False
Service Key (for triggering, acknowledging and resolving events only)		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incident type		False
Initial Fetch Interval (In minutes, used only for first fetch or after Reset last run)		False
Default requestor ID for adding people to incidents		False
Maximum number of incidents per fetch	The maximum number of incidents to retrieve per fetch cycle. Hard upper limit is 200.	False
Incident statuses to fetch	The statuses of PagerDuty incidents to ingest. Include “resolved” to capture short-lived incidents.	False

Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

By default, the integration will import PagerDuty incidents data as Cortex XSOAR incidents. All incidents created in the minute prior to the configuration of Fetch Incidents and up to current time will be imported.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get all schedules: PagerDuty-get-all-schedules
Get information for on-call users by time or schedule: PagerDuty-get-users-on-call
Get information for current on-call users: PagerDuty-get-users-on-call-now
Get incidents: PagerDuty-incidents
Create a new event/incident: PagerDuty-submit-event
Get the contact methods of a user: PagerDuty-get-contact-methods
Get a user’s notification rules: PagerDuty-get-users-notification
Resolve an event: PagerDuty-resolve-event
Acknowledge an event: PagerDuty-acknowledge-event
Get incident information: PagerDuty-get-incident-data
Get service keys for each configured service: PagerDuty-get-service-keys
Add responder to an incident: PagerDuty-add-responders
Run response play to an incident: PagerDuty-run-response-play

PagerDuty-get-all-schedules

Receive all schedules from PagerDuty.

Base Command

PagerDuty-get-all-schedules

Input

Argument Name	Description	Required
query	Show only the schedules whose name matches the query.	Optional
limit	The limit for the amount of schedules to receive(Default is 25, max value is 100).	Optional

Context Output

Path	Type	Description
PagerDuty.Schedules.id	string	The ID of the schedule.
PagerDuty.Schedules.name	string	The name of the schedule.

Command Example


#### Context Example

```json
{
    "PagerDuty": {
        "Schedules": [
            {
                "escalation_policies": [
                    {
                        "id": "someid",
                        "name": "Default"
                    }
                ],
                "id": "scheduleid",
                "name": "New Schedule #1",
                "time_zone": "America/Los_Angeles",
                "today": "2021-03-10"
            },
            {
                "escalation_policies": [
                    {
                        "id": "anotherid",
                        "name": "test policy"
                    }
                ],
                "id": "anotherscheduleid",
                "name": "New Schedule #2",
                "time_zone": "Europe/Athens",
                "today": "2021-03-10"
            }
        ]
    }
}

Human Readable Output

All Schedules

ID Name Today Time Zone Escalation Policy Escalation Policy ID

scheduleid New Schedule #1 2021-03-10 America/Los_Angeles Default someid

anotherscheduleid New Schedule #2 2021-03-10 Europe/Athens test policy anotherid

ID	Name	Today	Time Zone	Escalation Policy	Escalation Policy ID
scheduleid	New Schedule #1	2021-03-10	America/Los_Angeles	Default	someid
anotherscheduleid	New Schedule #2	2021-03-10	Europe/Athens	test policy	anotherid

PagerDuty-get-users-on-call

Returns the names and details of on call users at a certain time or by specific schedule.

Base Command

PagerDuty-get-users-on-call

Input

Argument Name	Description	Required
scheduleID	(default and mandatory) The unique identifier of the schedule.	Required
since	The start of the date range Using ISO 8601 Representation. Maximum range is 6 months and default is 1 month. E.g. !PagerDutyGetUsersOnCall since=2011-05-06T17:00Z.	Optional
until	The end of the date range. Maximum range is 6 months and default is 1 month.	Optional

Context Output

Path	Type	Description
PagerDutyUser.id	string	User’s ID.
PagerDutyUser.Emails	string	Email of user.
PagerDutyUser.Username	string	Username of person.
PagerDutyUser.DisplayName	string	Display name of person.
PagerDutyUser.Role	string	Display role of person.
PagerDutyUser.TimeZone	string	The time zone of the user.

Command Example

!PagerDuty-get-users-on-call scheduleID=scheduleid

Context Example

{
    "PagerDutyUser": [
        {
            "DisplayName": "Demisto User",
            "Email": "demisto@demisto.com",
            "ID": "someid",
            "Role": "owner",
            "TimeZone": "Europe/Athens",
            "Username": "Demisto User"
        },
        {
            "DisplayName": "Another User",
            "Email": "demisto@gmail.com",
            "ID": "anotherid",
            "Role": "user",
            "TimeZone": "Europe/Athens",
            "Username": "Another User"
        }
    ]
}

Human Readable Output

Users On Call

ID Email Name Role User Url Time Zone

someid demisto@demisto.com Demisto User owner https://demisto.pagerduty.com/users/someid Europe/Athens

anotherid demisto@mail.com Another User user https://demisto.pagerduty.com/users/anotherid Europe/Athens

ID	Email	Name	Role	User Url	Time Zone
someid	demisto@demisto.com	Demisto User	owner	https://demisto.pagerduty.com/users/someid	Europe/Athens
anotherid	demisto@mail.com	Another User	user	https://demisto.pagerduty.com/users/anotherid	Europe/Athens

PagerDuty-get-users-on-call-now

Returns the names and details of current on call personnel.

Base Command

PagerDuty-get-users-on-call-now

Input

Argument Name	Description	Required
limit	The limit for the amount of users to receive(Default is 25, max value is 100).	Optional
escalation_policy_ids	Filters the results, showing only on-call users for the specified escalation policy IDs.	Optional
schedule_ids	Filters the results, showing only on-call users for the specified schedule IDs. If the value is null, permanent on-call user are included due to direct user escalation policy targets.	Optional

Context Output

Path	Type	Description
PagerDutyUser.ID	string	User’s ID.
PagerDutyUser.Email	string	Email of user.
PagerDutyUser.Username	string	Username of person.
PagerDutyUser.DisplayName	string	Display name of person.
PagerDutyUser.Role	string	Role of person.
PagerDutyUser.TimeZone	string	The time zone of the user.

Command Example


#### Context Example

```json
{
    "PagerDutyUser": [
        {
            "DisplayName": "Demisto User",
            "Email": "demisto@demisto.com",
            "ID": "someid",
            "Role": "owner",
            "TimeZone": "Europe/Athens",
            "Username": "Demisto User"
        }
    ]
}

Human Readable Output

Users On Call Now

ID Email Name Role User Url Time Zone

someid demisto@demisto.com Demisto User owner https://demisto.pagerduty.com/users/someid Europe/Athens

ID	Email	Name	Role	User Url	Time Zone
someid	demisto@demisto.com	Demisto User	owner	https://demisto.pagerduty.com/users/someid	Europe/Athens

PagerDuty-incidents

Shows incidents in PagerDuty. Default status parameters are triggered,acknowledged.

Base Command

PagerDuty-incidents

Input

Argument Name	Description	Required
status	Returns only the incidents currently in the passed status(es). Valid status options are triggered,acknowledged, and resolved. (Default values are triggered,acknowledged). Possible values are: triggered, acknowledged, resolved.	Optional
since	Beginning date and time. Using ISO 8601 Representation. E.g. PagerDutyIncidents since=2011-05-06T17:00Z (must be used with until argument).	Optional
sortBy	Used to specify both the field you wish to sort the results on, as well as the direction (ascending/descending) of the results.See more https://v2.developer.pagerduty.com/v2/page/api-reference#!/Incidents/get_incidents.	Optional
until	Last date and time. Using ISO 8601 Representation. E.g. PagerDutyIncidents until=2016-05-06T13:00Z.	Optional
incident_key	Incident de-duplication key. E.g., 8e42eeb6391a4a2abeda5d12e09bddec.	Optional
limit	The maximum number of incidents to retrieve. If “page_size” is defined, this argument is ignored. Default is 50.	Optional
user_id	Comma separated list of User IDs. Returns only the incidents currently assigned to the passed user(s). Note: When using the assigned_to_user filter, you will only receive incidents with statuses of triggered or acknowledged. This is because resolved incidents are not assigned to any user.	Optional
urgencies	Array of the urgencies of the incidents to be returned. Defaults to all urgencies. Account must have the urgencies ability to do this. Possible values are: high, low.	Optional
date_range	When set to all, the since and until parameters and defaults are ignored. Possible values are: all.	Optional
page	The page number of incidents to retrieve (used for pagination) starting from 1. The page size is defined by the “page_size” argument.	Optional
page_size	The number of incidents per page to retrieve (used for pagination). The page number is defined by the “page” argument. The maximum value is 100.	Optional

Context Output

Path	Type	Description
PagerDuty.Incidents.ID	string	Incident ID.
PagerDuty.Incidents.Title	string	The title of the incident.
PagerDuty.Incidents.Status	string	Incident Status.
PagerDuty.Incidents.created_at	date	Time in which the incident was created.
PagerDuty.Incidents.urgency	string	Incident Urgency.
PagerDuty.Incidents.assignee	string	The assignee of the incident.
PagerDuty.Incidents.service_id	string	The id of the impacted service.
PagerDuty.Incidents.service_name	string	The name of the impacted service.
PagerDuty.Incidents.escalation_policy	string	The escalation policy.
PagerDuty.Incidents.last_status_change_at	date	Time in which the last status change occurred.
PagerDuty.Incidents.last_status_change_by	string	Name of the user who done the last status change.
PagerDuty.Incidents.number_of_escalations	number	Number of escalations that took place.
PagerDuty.Incidents.resolved_by	string	Name of the User who resolved the incident.
PagerDuty.Incidents.resolve_reason	string	The reason for resolving the issue.
PagerDuty.Incidents.Description	string	The Description of the incident.
PagerDuty.Incidents.teams.ID	string	The ID of the team assigned for the incident.
PagerDuty.Incidents.teams.ID	string	The name of the team assigned for the incident.
PagerDuty.Incidents.assignment.time	date	The time of the assignment to the incident.
PagerDuty.Incidents.assignment.assignee	string	The name of the assignee to the incident.
PagerDuty.Incidents.assignment.assigneeId	string	The ID of the assignee to the incident.
PagerDuty.Incidents.acknowledgement.time	date	The time of the acknowledgement to the incident.
PagerDuty.Incidents.acknowledgement.acknowledger	string	The name of the acknowledger to the incident.
PagerDuty.Incidents.acknowledgement.acknowledgerId	string	The ID of the acknowledger to the incident.
PagerDuty.Incidents.incident_key	String	The incident’s de-duplication key.

Command Example


#### Context Example

```json
{
    "PagerDuty": {
        "Incidents": [
            {
                "Description": {
                    "description": "No description"
                },
                "ID": "someid",
                "Status": "acknowledged",
                "Title": "[#264] Ticket 01439490",
                "acknowledgement": {
                    "acknowledger": "someone",
                    "acknowledgerId": "ABC123",
                    "time": "2021-03-04T08:53:04Z"
                },
                "assignee": "someone",
                "assignment": {
                    "assignee": "someone",
                    "assigneeId": "ABC123",
                    "time": "2021-03-04T08:53:04Z"
                },
                "created_at": "2021-03-04T08:52:56Z",
                "escalation_policy": "Default",
                "incident_key": null,
                "last_status_change_at": "2021-03-04T08:53:04Z",
                "last_status_change_by": "someone",
                "number_of_escalations": null,
                "resolve_reason": "",
                "resolved_by": "someone",
                "service_id": "P5CX6RZ",
                "service_name": "PD SF",
                "teams": [],
                "urgency": "high"
            },
            {
                "Description": {
                    "description": "No description"
                },
                "ID": "anotherid",
                "Status": "triggered",
                "Title": "[#278] my event",
                "acknowledgement": {},
                "assignee": "someone-else",
                "assignment": {
                    "assignee": "someone-else",
                    "assigneeId": "ABC123",
                    "time": "2021-03-10T08:37:17Z"
                },
                "created_at": "2021-03-10T07:57:16Z",
                "escalation_policy": "Default",
                "incident_key": "somekey",
                "last_status_change_at": "2021-03-10T08:37:17Z",
                "last_status_change_by": "API Service",
                "number_of_escalations": null,
                "resolve_reason": "",
                "resolved_by": "someone-else",
                "service_id": "someid",
                "service_name": "API Service",
                "teams": [],
                "urgency": "high"
            }
        ]
    }
}

Human Readable Output

PagerDuty Incidents

ID Title Description Status Created On Urgency Html Url Incident key Assigned To User Service ID Service Name Escalation Policy Last Status Change On Last Status Change By Resolved By User

someid [#264] Ticket 01439490 description: No description acknowledged 2021-03-04T08:52:56Z high https://demisto.pagerduty.com/incidents/someid someone P5CX6RZ PD SF Default 2021-03-04T08:53:04Z someone -

anotherid [#278] my event description: No description triggered 2021-03-10T07:57:16Z high https://demisto.pagerduty.com/incidents/anotherid somekey someone-else someid API Service Default 2021-03-10T08:37:17Z API Service -

ID	Title	Description	Status	Created On	Urgency	Html Url	Incident key	Assigned To User	Service ID	Service Name	Escalation Policy	Last Status Change On	Last Status Change By	Resolved By User
someid	[#264] Ticket 01439490	description: No description	acknowledged	2021-03-04T08:52:56Z	high	https://demisto.pagerduty.com/incidents/someid		someone	P5CX6RZ	PD SF	Default	2021-03-04T08:53:04Z	someone	-
anotherid	[#278] my event	description: No description	triggered	2021-03-10T07:57:16Z	high	https://demisto.pagerduty.com/incidents/anotherid	somekey	someone-else	someid	API Service	Default	2021-03-10T08:37:17Z	API Service	-

PagerDuty-submit-event

Creates a new event/incident in PagerDuty(In order to use this command you have to enter the Service Key in the integration settings).

Base Command

PagerDuty-submit-event

Input

Argument Name	Description	Required
source	Specific human-readable unique identifier, such as a hostname, for the system having the problem.	Required
summary	A high-level, text summary message of the event. Will be used to construct an alert’s description.	Required
severity	The severity of the event. Possible values are: critical, error, warning, info.	Required
action	The action to be executed. Possible values are: trigger, acknowledge, resolve.	Required
description	A short description of the problem.	Optional
group	A cluster or grouping of sources. For example, sources “prod-datapipe-02” and “prod-datapipe-03” might both be part of “prod-datapipe”. Example: “prod-datapipe” “www”.	Optional
event_class	The class/type of the event. Example: “High CPU” “Latency”.	Optional
component	The part or component of the affected system that is broken. Example: “keepalive” “webping”.	Optional
incident_key	Incident key, used to acknowledge/resolve specific event.	Optional
serviceKey	Service key for the integration.	Optional

Context Output

Path	Type	Description
PagerDuty.Event.Status	string	Status of the action on the event.
PagerDuty.Event.incident_key	string	Incident key.

Command Example

!PagerDuty-submit-event action=trigger severity=info source=demisto summary="my new event"

Human Readable Output

Incident key Message Status

somekey Event processed success

Incident key	Message	Status
somekey	Event processed	success

PagerDuty-get-contact-methods

Get the contact methods of a given user.

Base Command

PagerDuty-get-contact-methods

Input

Argument Name	Description	Required
UserID	ID of the wanted user.	Required

Context Output

Path	Type	Description
PagerDuty.Contact_methods.phone	string	The phone number of the user.
PagerDuty.Contact_methods.id	string	ID of the contact method.
PagerDuty.Contact_methods.type	string	The type of the current contact method.
PagerDuty.Contact_methods.email	string	The email of the user.

Command Example

!PagerDuty-get-contact-methods UserID=someid

Context Example

{
    "PagerDuty": {
        "Contact_methods": [
            {
                "email": "demisto@demisto.com",
                "html_url": null,
                "id": "someotherid",
                "label": "Default",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/someotherid",
                "send_html_email": false,
                "send_short_email": false,
                "summary": "Default",
                "type": "email_contact_method"
            },
            {
                "blacklisted": false,
                "html_url": null,
                "id": "someid",
                "label": "Mobile",
                "phone": "000000",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/someid",
                "summary": "Mobile",
                "type": "phone_contact_method"
            },
            {
                "blacklisted": false,
                "enabled": true,
                "html_url": null,
                "id": "onemoreid",
                "label": "Mobile",
                "phone": "0000000",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/onemoreid",
                "summary": "Mobile",
                "type": "sms_contact_method"
            }
        ]
    }
}

Human Readable Output

Contact Methods

ID Type Details

someotherid Email demisto@demisto.com

someid Phone 0000000

onemoreid SMS 000000

ID	Type	Details
someotherid	Email	demisto@demisto.com
someid	Phone	0000000
onemoreid	SMS	000000

PagerDuty-get-users-notification

Get the users notification rules.

Base Command

PagerDuty-get-users-notification

Input

Argument Name	Description	Required
UserID	ID of the wanted user.	Required

Context Output

Path	Type	Description
PagerDuty.Notification_rules.start_delay_in_minutes	string	The delay time for notifying the user.
PagerDuty.Notification_rules.urgency	string	The urgency of the notification.
PagerDuty.Notification_rules.id	string	The id of the notification rule.

Command Example

!PagerDuty-get-users-notification UserID=someid

Context Example

{
    "PagerDuty": {
        "Notification_rules": {
            "contact_method": {
                "address": "demisto@demisto.com",
                "html_url": null,
                "id": "someotherid",
                "label": "Default",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/someotherid",
                "send_html_email": false,
                "send_short_email": false,
                "summary": "Default",
                "type": "email_contact_method"
            },
            "html_url": null,
            "id": "someid",
            "self": "https://api.pagerduty.com/users/someid/notification_rules/someid",
            "start_delay_in_minutes": 0,
            "summary": "0 minutes: channel someotherid",
            "type": "assignment_notification_rule",
            "urgency": "high"
        }
    }
}

Human Readable Output

User notification rules

ID Type Urgency Notification timeout(minutes)

someid assignment_notification_rule high 0

ID	Type	Urgency	Notification timeout(minutes)
someid	assignment_notification_rule	high	0

PagerDuty-resolve-event

Resolves an existing event in PagerDuty.

Base Command

PagerDuty-resolve-event

Input

Argument Name	Description	Required
incident_key	Incident key.	Required
serviceKey	Service key for the integration.	Optional

Context Output

Path	Type	Description
PagerDuty.Event.Status	string	Status of the action on the event.
PagerDuty.Event.incident_key	string	Incident key.

Command Example

!PagerDuty-resolve-event incident_key=somekey serviceKey=servicekey

Context Example

{
    "Event": {
        "ID": "somekey"
    },
    "PagerDuty": {
        "Event": {
            "Message": "Event processed",
            "Status": "success",
            "incident_key": "somekey"
        }
    }
}

Human Readable Output

Resolve Event

Incident key Message Status

somekey Event processed success

Incident key	Message	Status
somekey	Event processed	success

PagerDuty-acknowledge-event

Acknowledges an existing event in PagerDuty.

Base Command

PagerDuty-acknowledge-event

Input

Argument Name	Description	Required
incident_key	Incident key.	Required
serviceKey	Service key for the integration.	Optional

Context Output

Path	Type	Description
PagerDuty.Event.Status	string	Status of the action on the event.
PagerDuty.Event.incident_key	string	Incident key.

Command Example

!PagerDuty-acknowledge-event incident_key=somekey serviceKey=servicekey

Context Example

{
    "Event": {
        "ID": "8e42eeb6391a4a2abeda5d12e09bddec"
    },
    "PagerDuty": {
        "Event": {
            "Message": "Event processed",
            "Status": "success",
            "incident_key": "somekey"
        }
    }
}

Human Readable Output

Acknowledge Event

Incident key Message Status

somekey Event processed success

Incident key	Message	Status
somekey	Event processed	success

PagerDuty-get-incident-data

Get data about a incident from PagerDuty.

Base Command

PagerDuty-get-incident-data

Input

Argument Name	Description	Required
incident_id	ID of the incident to get information for.	Required

Context Output

Path	Type	Description
PagerDuty.Incidents.ID	string	Incident ID.
PagerDuty.Incidents.Title	string	The title of the incident.
PagerDuty.Incidents.Status	string	Incident Status.
PagerDuty.Incidents.created_at	date	Time in which the incident was created.
PagerDuty.Incidents.urgency	string	Incident Urgency.
PagerDuty.Incidents.assignee	string	The assignee of the incident.
PagerDuty.Incidents.service_id	string	The id of the impacted service.
PagerDuty.Incidents.service_name	string	The name of the impacted service.
PagerDuty.Incidents.escalation_policy	string	The escalation policy.
PagerDuty.Incidents.last_status_change_at	date	Time in which the last status change occurred.
PagerDuty.Incidents.last_status_change_by	string	Name of the user who done the last status change.
PagerDuty.Incidents.number_of_escalations	number	Number of escalations that took place.
PagerDuty.Incidents.resolved_by	string	Name of the User who resolved the incident.
PagerDuty.Incidents.resolve_reason	string	The reason for resolving the issue.
PagerDuty.Incidents.Description	string	The Description of the incident.
PagerDuty.Incidents.teams.ID	string	The ID of the team assigned for the incident.
PagerDuty.Incidents.teams.ID	string	The name of the team assigned for the incident.
PagerDuty.Incidents.assignment.time	date	The time of the assignment to the incident.
PagerDuty.Incidents.assignment.assignee	string	The name of the assignee to the incident.
PagerDuty.Incidents.assignment.assigneeId	string	The ID of the assignee to the incident.
PagerDuty.Incidents.acknowledgement.time	date	The time of the acknowledgement to the incident.
PagerDuty.Incidents.acknowledgement.acknowledger	string	The name of the acknowledger to the incident.
PagerDuty.Incidents.acknowledgement.acknowledgerId	string	The ID of the acknowledger to the incident.
PagerDuty.Incidents.incident_key	String	The incident’s de-duplication key.

Command Example

!PagerDuty-get-incident-data incident_id=someid

Context Example

{
    "PagerDuty": {
        "Incidents": {
            "Description": "",
            "ID": "someid",
            "Status": "acknowledged",
            "Title": "[#281] my new event",
            "acknowledgement": {
                "acknowledgerId": "ABC123",
                "acknowledger": "someone",
                "time": "2021-03-10T09:31:48Z"
            },
            "assignee": null,
            "assignment": {
                "assignee": "someone",
                "assigneeId": "ABC123",
                "time": "2021-03-10T09:31:48Z"
            },
            "created_at": "2021-03-10T09:31:48Z",
            "escalation_policy": "Default",
            "incident_key": "somekey",
            "last_status_change_at": "2021-03-10T10:00:50Z",
            "last_status_change_by": "API Service",
            "number_of_escalations": null,
            "resolve_reason": "",
            "resolved_by": null,
            "service_id": "someid",
            "service_name": "API Service",
            "teams": [],
            "urgency": "high"
        }
    }
}

Human Readable Output

PagerDuty Incident

ID Title Status Created On Urgency Html Url Incident key Service ID Service Name Escalation Policy Last Status Change On Last Status Change By Resolved By User

someid [#281] my new event acknowledged 2021-03-10T09:31:48Z high https://demisto.pagerduty.com/incidents/someid 8e42eeb6391a4a2abeda5d12e09bddec someid API Service Default 2021-03-10T10:00:50Z API Service -

ID	Title	Status	Created On	Urgency	Html Url	Incident key	Service ID	Service Name	Escalation Policy	Last Status Change On	Last Status Change By	Resolved By User
someid	[#281] my new event	acknowledged	2021-03-10T09:31:48Z	high	https://demisto.pagerduty.com/incidents/someid	8e42eeb6391a4a2abeda5d12e09bddec	someid	API Service	Default	2021-03-10T10:00:50Z	API Service	-

PagerDuty-get-service-keys

Get Service keys for each of the services configured in the PagerDuty instance.

Base Command

PagerDuty-get-service-keys

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
PagerDuty.Service.ID	string	The ID of the service connected to PagerDuty.
PagerDuty.Service.Name	string	The name of the service connected to PagerDuty.
PagerDuty.Service.Status	string	The status of the service connected to PagerDuty.
PagerDuty.Service.CreatedAt	date	The date in which the service connected to PagerDuty was created.
PagerDuty.Service.Integration.Name	string	The name of the integration used with the service.
PagerDuty.Service.Integration.Vendor	string	The name of the vendor for the integration used with the service.(A value of ‘Missing Vendor information’ will appear once no information could be found).
PagerDuty.Service.Integration.Key	string	The key used to control events with the integration.

Command Example


#### Context Example

```json
{
    "PagerDuty": {
        "Service": [
            {
                "CreatedAt": "2016-03-20T14:00:55+02:00",
                "ID": "someid",
                "Integration": [
                    {
                        "Key": "somekey",
                        "Name": "API Service",
                        "Vendor": "Missing Vendor information"
                    }
                ],
                "Name": "API Service",
                "Status": "critical"
            }
        ]
    }
}

Human Readable Output

Service List

ID Name Status Created At Integration

someid API Service critical 2016-03-20T14:00:55+02:00 Name: API Service, Vendor: Missing Vendor information, Key: somekey

ID	Name	Status	Created At	Integration
someid	API Service	critical	2016-03-20T14:00:55+02:00	Name: API Service, Vendor: Missing Vendor information, Key: somekey

PagerDuty-add-responders

Add responders to an incident.

Base Command

PagerDuty-add-responders

Input

Argument Name	Description	Required
incident_id	PagerDuty Incident ID to add responders to.	Required
message	Message to send to responders.	Required
user_requests	Comma separated list of User IDs to request response from.	Optional
escalation_policy_requests	Comma separated list of Escalation Policy IDs to request response from.	Optional
requestor_id	UserID sending the request (if blank, uses the default for the integration).	Optional

Command Example

!PagerDuty-add-responders incident_id=PXP12GZ UserRequests=P09TT3C,PAIXXX Message="Please join zoom meeting"

Context Output

Path	Type	Description
PagerDuty.ResponderRequests.ResponderID	String	The user ID of the responder added.
PagerDuty.ResponderRequests.ResponderName	String	The name of the responder added.

Context Example

{
    "PagerDuty": 
    {
        "ResponderRequests": [
            {
                "ID": "P09TT3C",
                "IncidentID": "PXP12GZ",
                "IncidentSummary": "[#31028] Test Incident for Demisto Integration - No Action",
                "Message": "Please help with issue - join bridge at +1(234)-567-8910",
                "RequesterID": "P09TT3C",
                "ResponderName": "John Doe",
                "ResponderType": "user_reference",
                "Type": "user"
            },
            {
                "ID": "PAIXXX",
                "IncidentID": "PXP12GZ",
                "IncidentSummary": "[#31028] Test Incident for Demisto Integration - No Action",
                "Message": "Please help with issue - join bridge at +1(234)-567-8910",
                "RequesterID": "P09TT3C",
                "ResponderName": "Jane Doe",
                "ResponderType": "user_reference",
                "Type": "user"
            }
        ]
    }
}

PagerDuty-run-response-play

Run a response play on PagerDuty (based on its UUID).

Response Plays are a package of Incident Actions that can be applied during an Incident’s life cycle.

Base Command

PagerDuty-run-response-play

Input

Argument Name	Description	Required
incident_id	The PagerDuty incident ID to run the play on.	Required
from_email	User’s email to trigger the response play from.	Required
response_play_uuid	The UUID of the response play to run.	Required

Command Example

!PagerDuty-run-response-play incident_id="Q107XAAAAMBBR" from_email="john.doe@example.com" response_play_uuid="111111-88bb-bb37-181d-11111111110dewsq"

Human Readable Output

Response play successfully run to the incident Q107XAAAAMBBR by john.doe@example.com

Configuration parameters

APIKey — API Key
credentials_api_key —
ServiceKey — Service Key (for triggering, acknowledging and resolving events only)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
FetchInterval — Initial Fetch Interval (In minutes, used only for first fetch or after Reset last run)
DefaultRequestor — Default requestor ID for adding people to incidents
max_fetch — Maximum number of incidents per fetch
incident_statuses — Incident statuses to fetch

Commands (13)

PagerDuty-acknowledge-event
Acknowledges an existing event in PagerDuty.
PagerDuty-add-responders
Add responders to an incident.
PagerDuty-get-all-schedules
Receive all schedules from PagerDuty.
PagerDuty-get-contact-methods
Get the contact methods of a given user.
PagerDuty-get-incident-data
Get data about a incident from PagerDuty.
PagerDuty-get-service-keys
Get Service keys for each of the services configured in the PagerDuty instance.
PagerDuty-get-users-notification
Get the users notification rules.
PagerDuty-get-users-on-call
Returns the names and details of on call users at a certain time or by specific schedule.
PagerDuty-get-users-on-call-now
Returns the names and details of current on call personnel.
PagerDuty-incidents
Shows incidents in PagerDuty. Default status parameters are triggered,acknowledged.
PagerDuty-resolve-event
Resolves an existing event in PagerDuty.
PagerDuty-run-response-play
Run a response play on PagerDuty (based on its UUID).
PagerDuty-submit-event
Creates a new event/incident in PagerDuty(In order to use this command you have to enter the Service Key in the integration settings).

Source

PagerDuty.py PagerDuty_test.py PagerDuty.yml PagerDuty_description.md command_examples.txt

Download History Raw

category: Messaging and Conferencing
provider: PagerDuty
sectionorder:
- Connect
- Collect
commonfields:
  id: PagerDuty v2
  version: -1
configuration:
- display: API Key
  name: APIKey
  type: 4
  section: Connect
  hidden: true
  required: false
- displaypassword: API Key
  name: credentials_api_key
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- display: Service Key (for triggering, acknowledging and resolving events only)
  name: ServiceKey
  type: 0
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '1'
  display: Initial Fetch Interval (In minutes, used only for first fetch or after Reset last run)
  name: FetchInterval
  type: 0
  section: Collect
  required: false
- display: Default requestor ID for adding people to incidents
  name: DefaultRequestor
  type: 0
  section: Collect
  required: false
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: '50'
  type: 0
  section: Collect
  required: false
  additionalinfo: The maximum number of incidents to retrieve per fetch cycle. Hard upper limit is 200. Increase if your environment ingests more PagerDuty incidents per fetch interval than the configured default.
  supportedModules:
  - agentix
  - xsiam
- display: Incident statuses to fetch
  name: incident_statuses
  defaultvalue: triggered,acknowledged
  type: 16
  section: Collect
  required: false
  additionalinfo: The statuses of PagerDuty incidents to ingest. Include "resolved" to capture short-lived incidents that move to resolved between fetch cycles.
  options:
  - triggered
  - acknowledged
  - resolved
description: Alert and notify users using PagerDuty.
display: PagerDuty v2
name: PagerDuty v2
script:
  commands:
  - arguments:
    - description: Show only the schedules whose name matches the query.
      name: query
    - description: The limit for the amount of schedules to receive(Default is 25, max value is 100).
      name: limit
    description: Receive all schedules from PagerDuty.
    name: PagerDuty-get-all-schedules
    outputs:
    - contextPath: PagerDuty.Schedules.id
      description: The ID of the schedule.
      type: string
    - contextPath: PagerDuty.Schedules.name
      description: The name of the schedule.
      type: string
  - arguments:
    - default: true
      description: (default and mandatory) The unique identifier of the schedule.
      name: scheduleID
      required: true
    - description: The start of the date range Using ISO 8601 Representation. Maximum range is 6 months and default is 1 month. E.g. !PagerDutyGetUsersOnCall since=2011-05-06T17:00Z.
      name: since
    - description: The end of the date range. Maximum range is 6 months and default is 1 month.
      name: until
    description: Returns the names and details of on call users at a certain time or by specific schedule.
    name: PagerDuty-get-users-on-call
    outputs:
    - contextPath: PagerDutyUser.id
      description: User's ID.
      type: string
    - contextPath: PagerDutyUser.Emails
      description: Email of user.
      type: string
    - contextPath: PagerDutyUser.Username
      description: Username of person.
      type: string
    - contextPath: PagerDutyUser.DisplayName
      description: Display name of person.
      type: string
    - contextPath: PagerDutyUser.Role
      description: Display role of person.
      type: string
    - contextPath: PagerDutyUser.TimeZone
      description: The time zone of the user.
      type: string
  - arguments:
    - description: The limit for the amount of users to receive(Default is 25, max value is 100).
      name: limit
    - description: Filters the results, showing only on-call users for the specified escalation policy IDs.
      isArray: true
      name: escalation_policy_ids
    - description: Filters the results, showing only on-call users for the specified schedule IDs. If the value is null, permanent on-call user are included due to direct user escalation policy targets.
      isArray: true
      name: schedule_ids
    description: Returns the names and details of current on call personnel.
    name: PagerDuty-get-users-on-call-now
    outputs:
    - contextPath: PagerDutyUser.ID
      description: User's ID.
      type: string
    - contextPath: PagerDutyUser.Email
      description: Email of user.
      type: string
    - contextPath: PagerDutyUser.Username
      description: Username of person.
      type: string
    - contextPath: PagerDutyUser.DisplayName
      description: Display name of person.
      type: string
    - contextPath: PagerDutyUser.Role
      description: Role of person.
      type: string
    - contextPath: PagerDutyUser.TimeZone
      description: The time zone of the user.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: Returns only the incidents currently in the passed status(es). Valid status options are triggered,acknowledged, and resolved. (Default values are triggered,acknowledged).
      name: status
      predefined:
      - triggered
      - acknowledged
      - resolved
    - description: Beginning date and time. Using ISO 8601 Representation. E.g. PagerDutyIncidents since=2011-05-06T17:00Z (must be used with until argument).
      name: since
    - description: Used to specify both the field you wish to sort the results on, as well as the direction (ascending/descending) of the results.See more https://v2.developer.pagerduty.com/v2/page/api-reference#!/Incidents/get_incidents.
      name: sortBy
    - description: Last date and time.  Using ISO 8601 Representation. E.g. PagerDutyIncidents until=2016-05-06T13:00Z.
      name: until
    - description: Incident de-duplication key. E.g., 8e42eeb6391a4a2abeda5d12e09bddec.
      name: incident_key
    - description: The maximum number of incidents to retrieve. If "page_size" is defined, this argument is ignored.
      name: limit
      defaultValue: 50
    - description: "Comma separated list of User IDs. Returns only the incidents currently assigned to the passed user(s). Note: When using the assigned_to_user filter, you will only receive incidents with statuses of triggered or acknowledged. This is because resolved incidents are not assigned to any user."
      name: user_id
    - auto: PREDEFINED
      description: Array of the urgencies of the incidents to be returned. Defaults to all urgencies. Account must have the urgencies ability to do this.
      name: urgencies
      predefined:
      - high
      - low
    - auto: PREDEFINED
      description: When set to all, the since and until parameters and defaults are ignored.
      name: date_range
      predefined:
      - all
    - description: The page number of incidents to retrieve (used for pagination) starting from 1. The page size is defined by the "page_size" argument.
      name: page
    - description: The number of incidents per page to retrieve (used for pagination). The page number is defined by the "page" argument. The maximum value is 100.
      name: page_size
    description: Shows incidents in PagerDuty. Default status parameters are triggered,acknowledged.
    name: PagerDuty-incidents
    outputs:
    - contextPath: PagerDuty.Incidents.ID
      description: Incident ID.
      type: string
    - contextPath: PagerDuty.Incidents.Title
      description: The title of the incident.
      type: string
    - contextPath: PagerDuty.Incidents.Status
      description: Incident Status.
      type: string
    - contextPath: PagerDuty.Incidents.created_at
      description: Time in which the incident was created.
      type: date
    - contextPath: PagerDuty.Incidents.urgency
      description: Incident Urgency.
      type: string
    - contextPath: PagerDuty.Incidents.assignee
      description: 'The assignee of the incident.'
      type: string
    - contextPath: PagerDuty.Incidents.service_id
      description: The id of the impacted service.
      type: string
    - contextPath: PagerDuty.Incidents.service_name
      description: The name of the impacted service.
      type: string
    - contextPath: PagerDuty.Incidents.escalation_policy
      description: The escalation policy.
      type: string
    - contextPath: PagerDuty.Incidents.last_status_change_at
      description: Time in which the last status change occurred.
      type: date
    - contextPath: PagerDuty.Incidents.last_status_change_by
      description: Name of the user who done the last status change.
      type: string
    - contextPath: PagerDuty.Incidents.number_of_escalations
      description: Number of escalations that took place.
      type: number
    - contextPath: PagerDuty.Incidents.resolved_by
      description: Name of the User who resolved the incident.
      type: string
    - contextPath: PagerDuty.Incidents.resolve_reason
      description: The reason for resolving the issue.
      type: string
    - contextPath: PagerDuty.Incidents.Description
      description: The Description of the incident.
      type: string
    - contextPath: PagerDuty.Incidents.teams.ID
      description: The ID of the team assigned for the incident.
      type: string
    - contextPath: PagerDuty.Incidents.teams.ID
      description: The name of the team assigned for the incident.
      type: string
    - contextPath: PagerDuty.Incidents.assignment.time
      description: The time of the assignment to the incident.
      type: date
    - contextPath: PagerDuty.Incidents.assignment.assignee
      description: The name of the assignee to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.assignment.assigneeId
      description: The ID of the assignee to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.acknowledgement.time
      description: The time of the acknowledgement to the incident.
      type: date
    - contextPath: PagerDuty.Incidents.acknowledgement.acknowledger
      description: The name of the acknowledger to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.acknowledgement.acknowledgerId
      description: The ID of the acknowledger to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.incident_key
      description: The incident's de-duplication key.
      type: String
  - arguments:
    - description: Specific human-readable unique identifier, such as a hostname, for the system having the problem.
      name: source
      required: true
    - description: "\t A high-level, text summary message of the event. Will be used to construct an alert's description."
      name: summary
      required: true
    - auto: PREDEFINED
      description: The severity of the event.
      name: severity
      predefined:
      - critical
      - error
      - warning
      - info
      required: true
    - auto: PREDEFINED
      description: The action to be executed.
      name: action
      predefined:
      - trigger
      - acknowledge
      - resolve
      required: true
    - description: A short description of the problem.
      name: description
    - description: 'A cluster or grouping of sources. For example, sources “prod-datapipe-02” and “prod-datapipe-03” might both be part of “prod-datapipe”. Example: "prod-datapipe" "www".'
      name: group
    - description: 'The class/type of the event. Example: "High CPU" "Latency".'
      name: event_class
    - description: 'The part or component of the affected system that is broken. Example: "keepalive" "webping".'
      name: component
    - description: Incident key, used to acknowledge/resolve specific event.
      name: incident_key
    - description: Service key for the integration.
      name: serviceKey
    description: Creates a new event/incident in PagerDuty(In order to use this command you have to enter the Service Key in the integration settings).
    name: PagerDuty-submit-event
    outputs:
    - contextPath: PagerDuty.Event.Status
      description: Status of the action on the event.
      type: string
    - contextPath: PagerDuty.Event.incident_key
      description: Incident key.
      type: string
  - arguments:
    - description: 'ID of the wanted user.'
      name: UserID
      required: true
    description: Get the contact methods of a given user.
    name: PagerDuty-get-contact-methods
    outputs:
    - contextPath: PagerDuty.Contact_methods.phone
      description: The phone number of the user.
      type: string
    - contextPath: PagerDuty.Contact_methods.id
      description: ID of the contact method.
      type: string
    - contextPath: PagerDuty.Contact_methods.type
      description: The type of the current contact method.
      type: string
    - contextPath: PagerDuty.Contact_methods.email
      description: The email of the user.
      type: string
  - arguments:
    - description: ID of the wanted user.
      name: UserID
      required: true
    description: Get the users notification rules.
    name: PagerDuty-get-users-notification
    outputs:
    - contextPath: PagerDuty.Notification_rules.start_delay_in_minutes
      description: The delay time for notifying the user.
      type: string
    - contextPath: PagerDuty.Notification_rules.urgency
      description: The urgency of the notification.
      type: string
    - contextPath: PagerDuty.Notification_rules.id
      description: The id of the notification rule.
      type: string
  - arguments:
    - description: Incident key.
      name: incident_key
      required: true
    - description: Service key for the integration.
      name: serviceKey
    description: Resolves an existing event in PagerDuty.
    name: PagerDuty-resolve-event
    outputs:
    - contextPath: PagerDuty.Event.Status
      description: Status of the action on the event.
      type: string
    - contextPath: PagerDuty.Event.incident_key
      description: Incident key.
      type: string
  - arguments:
    - description: Incident key.
      name: incident_key
      required: true
    - description: Service key for the integration.
      name: serviceKey
    description: Acknowledges an existing event in PagerDuty.
    name: PagerDuty-acknowledge-event
    outputs:
    - contextPath: PagerDuty.Event.Status
      description: Status of the action on the event.
      type: string
    - contextPath: PagerDuty.Event.incident_key
      description: Incident key.
      type: string
  - arguments:
    - description: ID of the incident to get information for.
      name: incident_id
      required: true
    description: Get data about a incident from PagerDuty.
    name: PagerDuty-get-incident-data
    outputs:
    - contextPath: PagerDuty.Incidents.ID
      description: Incident ID.
      type: string
    - contextPath: PagerDuty.Incidents.Title
      description: The title of the incident.
      type: string
    - contextPath: PagerDuty.Incidents.Status
      description: Incident Status.
      type: string
    - contextPath: PagerDuty.Incidents.created_at
      description: Time in which the incident was created.
      type: date
    - contextPath: PagerDuty.Incidents.urgency
      description: Incident Urgency.
      type: string
    - contextPath: PagerDuty.Incidents.assignee
      description: The assignee of the incident.
      type: string
    - contextPath: PagerDuty.Incidents.service_id
      description: The id of the impacted service.
      type: string
    - contextPath: PagerDuty.Incidents.service_name
      description: The name of the impacted service.
      type: string
    - contextPath: PagerDuty.Incidents.escalation_policy
      description: The escalation policy.
      type: string
    - contextPath: PagerDuty.Incidents.last_status_change_at
      description: Time in which the last status change occurred.
      type: date
    - contextPath: PagerDuty.Incidents.last_status_change_by
      description: Name of the user who done the last status change.
      type: string
    - contextPath: PagerDuty.Incidents.number_of_escalations
      description: Number of escalations that took place.
      type: number
    - contextPath: PagerDuty.Incidents.resolved_by
      description: Name of the User who resolved the incident.
      type: string
    - contextPath: PagerDuty.Incidents.resolve_reason
      description: The reason for resolving the issue.
      type: string
    - contextPath: PagerDuty.Incidents.Description
      description: The Description of the incident.
      type: string
    - contextPath: PagerDuty.Incidents.teams.ID
      description: The ID of the team assigned for the incident.
      type: string
    - contextPath: PagerDuty.Incidents.teams.ID
      description: The name of the team assigned for the incident.
      type: string
    - contextPath: PagerDuty.Incidents.assignment.time
      description: The time of the assignment to the incident.
      type: date
    - contextPath: PagerDuty.Incidents.assignment.assignee
      description: The name of the assignee to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.assignment.assigneeId
      description: The ID of the assignee to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.acknowledgement.time
      description: The time of the acknowledgement to the incident.
      type: date
    - contextPath: PagerDuty.Incidents.acknowledgement.acknowledger
      description: The name of the acknowledger to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.acknowledgement.acknowledgerId
      description: The ID of the acknowledger to the incident.
      type: string
    - contextPath: PagerDuty.Incidents.incident_key
      description: The incident's de-duplication key.
      type: String
  - description: Get Service keys for each of the services configured in the PagerDuty instance.
    name: PagerDuty-get-service-keys
    outputs:
    - contextPath: PagerDuty.Service.ID
      description: The ID of the service connected to PagerDuty.
      type: string
    - contextPath: PagerDuty.Service.Name
      description: The name of the service connected to PagerDuty.
      type: string
    - contextPath: PagerDuty.Service.Status
      description: The status of the service connected to PagerDuty.
      type: string
    - contextPath: PagerDuty.Service.CreatedAt
      description: The date in which the service connected to PagerDuty was created.
      type: date
    - contextPath: PagerDuty.Service.Integration.Name
      description: The name of the integration used with the service.
      type: string
    - contextPath: PagerDuty.Service.Integration.Vendor
      description: The name of the vendor for the integration used with the service.(A value of 'Missing Vendor information' will appear once no information could be found).
      type: string
    - contextPath: PagerDuty.Service.Integration.Key
      description: The key used to control events with the integration.
      type: string
  - arguments:
    - description: PagerDuty Incident ID to add responders to.
      name: incident_id
      required: true
    - description: Message to send to responders.
      name: message
      required: true
    - description: Comma separated list of User IDs to request response from.
      name: user_requests
    - description: Comma separated list of Escalation Policy IDs to request response from.
      name: escalation_policy_requests
    - description: UserID sending the request (if blank, uses the default for the integration).
      name: requestor_id
    description: Add responders to an incident.
    name: PagerDuty-add-responders
    outputs:
    - contextPath: PagerDuty.ResponderRequests.ResponderID
      description: The user ID of the responder added.
      type: String
    - contextPath: PagerDuty.ResponderRequests.ResponderName
      description: The name of the responder added.
      type: String
  - arguments:
    - description: The PagerDuty incident ID to run the play on.
      name: incident_id
      required: true
    - description: User's email to trigger the response play from.
      name: from_email
      required: true
    - description: The UUID of the response play to run.
      name: response_play_uuid
      required: true
    name: PagerDuty-run-response-play
    description: Run a response play on PagerDuty (based on its UUID).
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- PagerDuty Test
fromversion: 5.0.0