In this section:
Feedback:

PagerDuty

Anomali supports the ingestion of PagerDuty logs through the PagerDuty REST API v2.

REST API

You can use your existing API token or create a new token to add a new log source in the Anomali platform.

Onboarding steps

Step 1: Create API token

  1. Sign into the PagerDuty console.

  2. Navigate to Integrations > Developer Tools > API Access Keys.

  3. Click Create New API Key.

  4. Enter a description for the token, for example, Anomali API token. Securely store the token value for the subsequent steps.

  5. Click Create Key.

For more information, see PagerDuty's guide to Create API Access Keys.

Step 2: Add PagerDuty as a new log source

To add PagerDuty as a new log source on the Anomali platform:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the log source.

  5. Select PagerDuty as the source type.

  6. Select API as the ingestion method.

  7. Select API as the ingest method.

  8. Provide the Basic Configuration details:

    1. Token: Enter your existing token ID or the new token you created in Step 1: Create API token.

    2. PagerDuty domain: Enter your PagerDuty domain name.

    3. (Optional) Enabled actions: Provide all the PagerDuty enabled actions you would like to ingest into Anomali.

    4. (Optional) Enabled actor ID: Provide the enabled actor ID.

    5. (Optional) Enabled actor type: Provide the enabled actor type.

    6. (Optional) Enabled method type: Provide the enabled method type.

    7. (Optional) Enabled root resource types: Provide all the enabled root resource types.

  9. (Optional) Next to the Basic Configuration section, click on the Advanced Options link to provide additional information about the event log data:

    1. Enter one or more parameters that provide additional context about the data. For example, "File format" indicates the format of the event log data being shipped, or "File extension" that indicates the extension of the logs.

    2. Enter the corresponding value of the parameter. For example, CSV is a file format. Similarly, ".gzip" is a file extension.

  10. Click Save to add the log source.

Step 3: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 4: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 5: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.