Connect PagerDuty

Firefight has a dedicated alert source for PagerDuty. Each PagerDuty incident becomes an alert that resolves when the incident resolves in PagerDuty, and the same source tells Firefight when someone acknowledges, escalates or adds a note to a page.

Set up the Firefight side

Go to Settings → Alert Sources, click Add source, give it a name like “PagerDuty”, and pick the PagerDuty provider. When you create it, Firefight opens the source’s setup. It shows the ingest URL and a Copy token button for the source’s secret token, and the same steps as this page.

Set up the PagerDuty side

1. In PagerDuty, add a generic webhook (v3) subscription with the ingest URL.
2. Subscribe it to incident.triggered, incident.reopened, incident.resolved, incident.acknowledged, incident.escalated and incident.annotated.
3. Add a custom header named X-Firefight-Token holding the token.

Requests that fail the check are rejected with 401, and the source’s row in Settings → Alert Sources shows the rejection. Firefight accepts and ignores every other event, such as the ping a new subscription sends, so PagerDuty never turns the subscription off.

What Firefight reads

Each alert gets these fields, which you can match in your routing rules.

Field	Value
title	The PagerDuty incident’s title
description	The PagerDuty incident number and a link to it
service	The PagerDuty service
severity_raw	The incident’s priority, such as P1, or its urgency when it has no priority
team	The incident’s first team
url	The incident in PagerDuty

The alert’s title in Slack and on the dashboard links to its page in PagerDuty. Map PagerDuty’s priorities to your severities in the source’s Severity map.

Firing and resolving

A triggered or reopened incident fires the alert, and a resolved one resolves it. Every event about the same PagerDuty incident lands on the same Firefight alert.

Pages kept in step

When a PagerDuty alert joins a Firefight incident, or when Firefight raised the page itself, the page and the incident stay in step. An acknowledgement, an escalation or a note in PagerDuty shows on the incident’s timeline. A page Firefight raised comes back through this source as an alert and joins the incident it was raised for, so it never opens a second one.

Changes in the other direction, such as resolving the incident in Firefight resolving the page in PagerDuty, go through a PagerDuty connection under Integrations. See Halon on call for raising pages and everything that stays in step.

See Grouping & deduplication for how repeat firings collapse into one alert.