You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Other Notable Integrations | CircleCI, Jira, New Relic, StatusPage | Jira, New Relic, Statuspage | Jira, New Relic, Statuspage |
92
+
| Other Notable Integrations | CircleCI, Jira, New Relic, StatusPage| Jira, New Relic, Statuspage | Jira, New Relic, Statuspage |
93
93
| Data Retention | 1 year (unlimited at $29) | Unlimited | Not listed (but unlimited noted at $49) |
94
94
| Terraform Provider | No ([abandoned](https://www.terraform.io/docs/providers/opsgenie/index.html)) |[Yes](https://www.terraform.io/docs/providers/pagerduty/index.html)| No official provider, some limited attempts |
You're not quite done yet. PagerDuty does not actually authorize the link between the extension and Slack until you manually create it. Sign into PagerDuty and [visit the extensions page](https://movemil.pagerduty.com/extensions). Locate your new extension in the Service Extensions table and click on the gear button on the bottom right of the far-right Details cell for your extension. Select either the Re-authorize/Authorize or Edit option (they do the same thing) from the drop-down. Scroll down and select the channel you prefer under `Where should PagerDuty post?` then click "Allow". You should see a notification appear in the channel you've selected in Slack that says "\[your name\] added an integration to this channel: PagerDuty". Make sure to record that you've done this in your Manual Operations log. Note: You only need to create one extension per service rather than per environment.
289
+
You're not quite done yet. PagerDuty does not actually authorize the link between the extension and Slack until you manually create it. Sign into PagerDuty and [visit the extensions page](https://movemil.pagerduty.com/extensions). Locate your new extension in the Service Extensions table and click on the gear button on the bottom right of the far-right Details cell for your extension. Select either the Re-authorize/Authorize or Edit option (they do the same thing) from the drop-down. Scroll down and select the channel you prefer under `Where should PagerDuty post?` then click "Allow". You should see a notification appear in the channel you've selected in Slack that says "[your name] added an integration to this channel: PagerDuty". Make sure to record that you've done this in your Manual Operations log. Note: You only need to create one extension per service rather than per environment.
290
290
291
291
## GuardDuty Tie-In
292
292
@@ -323,4 +323,4 @@ When an alert occurs and you are notified via PagerDuty or Slack, you'll have to
323
323
324
324
1. Immediately Acknowledge the finding, which you can do via the PagerDuty app, website, or Slack integration.
325
325
1. Once you've found a resolution for the incident, you should Resolve it (which again you can do via app, site, or on Slack).
326
-
1. Archive the relevant GuardDuty finding using the AWS Console. Because you've set your `infrasec` as the administrative account for GuardDuty, all findings for member accounts "roll up" there. Depending on whether the alerts are in the GovCloud or Commercial space, that will be either the `project-com-infrasec` or `project-gov-infrasec` account. Make sure you are in the correct region (either `us-west-2` or `us-east-1`, depending on where the alert fired). Confirm the alert you are archiving fired in the account you expected by checking the `Account ID` column in the Findings table.
326
+
1. Archive the relevant GuardDuty finding using the AWS Console. Because you've set your `infrasec` as the administrative account for GuardDuty, all findings for member accounts "roll up" there. Depending on whether the alerts are in the GovCloud or Commercial space, that will be either the `project-com-infrasec` or `project-gov-infrasec` account. Make sure you are in the correct region (either `us-west-2` or `us-east-1`, depending on where the alert fired). Confirm the alert you are archiving fired in the account you expected by checking the `Account ID` column in the Findings table.
0 commit comments