Before
Responders likely had to open each PagerDuty incident, retrieve its details and notes, extract IP addresses, and research each address across geolocation and reputation sources. They also had to manually document findings, update the incident, look up associated users, and create a separate trouble ticket when further tracking was needed.
How it works
- Receive the PagerDuty webhook and classify the incident to select the appropriate remediation path.
- Retrieve incident or user information, extract and investigate IP addresses when applicable, and gather the relevant enrichment details.
- Write the results back to PagerDuty, post a status update when required, and create a trouble ticket for continued tracking.
Workflow details
- Trigger and routing: A PagerDuty webhook starts the workflow, which evaluates the incident type and routes the event to the appropriate remediation path.
- Incident enrichment: For the relevant incident path, the workflow retrieves the incident, reviews its existing notes, extracts IP addresses from the incident information, and processes each extracted address.
- IP investigation: Each IP address is checked for geolocation details, reviewed against blocklist activity from the last 24 hours, and looked up in GreyNoise Community to gather additional context.
- PagerDuty documentation: The collected investigation details are compiled into a note on the PagerDuty incident so responders can review the enrichment in the incident record.
- Acknowledgment follow-up: For the other incident path, the workflow retrieves the associated PagerDuty user, adds a note based on that information, posts a status update, and creates a ServiceNow trouble ticket to track the issue further.
What changed
Incident classification, data retrieval, IP investigation, and documentation now occur automatically from the webhook, with results written directly to the PagerDuty record. The applicable acknowledgment path also creates the follow-up trouble ticket automatically instead of requiring a separate manual handoff.
Work removed
Retrieving incident details, reviewing incident notes, extracting IP addresses, performing geolocation and reputation lookups, compiling findings into incident notes, looking up associated users, posting status updates, and creating trouble tickets manually.
Expected outcome
Each qualifying incident can receive up to three automated IP enrichment lookups per extracted address, with the findings documented in PagerDuty and follow-up ticketing initiated when required.
