Connect PagerDuty to RansomLeak

Overview

RansomLeak for PagerDuty turns a security incident into a teaching moment. When an incident is routed to a responder, RansomLeak assigns that person a short five to ten minute module and posts completion back on the incident as a note, so the coaching and its evidence live where the response already happens.

An admin connects it once, and it runs on its own from then on:

• An incident routes to a responder
• A five to ten minute module is assigned
• Completion posts back as an incident note
• Idempotent, so it never assigns twice

Requirements

• A PagerDuty account on any plan that includes Webhooks v3, in the US or EU service region.
• The person who connects must be a PagerDuty Admin or Account Owner. The webhook subscription covers the whole account, and PagerDuty only lets those roles create one.
• A RansomLeak tenant, and an admin there who can open Settings → Integrations.
• Responders exist in RansomLeak under the same work email they use in PagerDuty. A responder with no matching RansomLeak user is skipped.

Install in one click

An admin connects from RansomLeak. There is no API key to copy or paste: PagerDuty issues an OAuth token, and RansomLeak creates the webhook subscription for you, so there is nothing to configure on each incident.

1. In RansomLeak, go to Settings → Integrations → PagerDuty and select Connect.

2. You are redirected to PagerDuty. Sign in as an Admin or Account Owner, choose the account, and approve the write access the app requests.

3. You land back in RansomLeak, which shows the connection as active. It has stored the OAuth tokens encrypted and created a Webhooks v3 subscription pointed at its receiver.

4. Pick which RansomLeak module is assigned when an incident routes to a responder, and save.

5. Under Security services, choose the PagerDuty services that raise security incidents, or keep all services, and save. That is the whole setup.

Access it requests, and why

The app requests PagerDuty's write OAuth scope, which is the scope available to apps listed in the PagerDuty App Directory. Your data is also limited by the role of the person who authorizes. The app uses that access for these calls only:

RansomLeak never creates, edits, acknowledges, reassigns, or resolves incidents, and never changes users, schedules, or services.

Events it handles

RansomLeak subscribes to four Webhooks v3 incident events. When one fires on a service you marked as a security service (or on any service, if you kept all of them), it resolves the responder's work email, assigns the configured module, and emails them a direct link to start it.

• incident.triggered
• incident.responder.added
• incident.reassigned
• incident.escalated

Completion write-back

When the assigned module is completed, RansomLeak posts a note on the originating incident, so the evidence sits on the timeline next to the rest of the response:

When the module has a quiz, the note ends with its result, for example Quiz passed (100%). or Quiz not passed (83%)., so a failed attempt is never reported as a clean completion.

The write-back uses the same OAuth connection, so there is no second credential to manage. Each completion posts at most once, so a retried or duplicate completion never double-posts.

Permissions and data handling

The integration reads as little as it can. It uses only the specific incident fields it needs to identify the affected employee, and never stores the incident body.

• Tokens and webhook secret encrypted at rest (AES-256-GCM)
• Deliveries verified with HMAC-SHA256
• Disconnect removes the subscription and tokens

Uninstall

1. In RansomLeak, go to Settings → Integrations → PagerDuty and select Disconnect.

2. RansomLeak deletes the Webhooks v3 subscription on the PagerDuty side and deletes the stored tokens and signing secret.

If you revoke the app inside PagerDuty instead, RansomLeak detects it on the next token refresh and clears the local connection automatically. Training already assigned stays in RansomLeak.

Support

RansomLeak supports this integration. For help connecting, a question, or a problem, email support@ransomleak.com. Include your RansomLeak tenant address and, if relevant, the PagerDuty incident number.

Frequently asked questions

Does RansomLeak integrate with PagerDuty?

Yes. An admin connects the RansomLeak app to PagerDuty once over OAuth 2.0, and from then on, when a security incident is routed to a responder, RansomLeak assigns that person a short five to ten minute security module and records completion back on the incident as a note. There is no per-incident wiring and no script to host.

How does an incident assign training?

On install, RansomLeak creates a Webhooks v3 subscription on your account and you pick which module is assigned. You can also limit it to the PagerDuty services that raise security incidents. When PagerDuty fires incident.triggered, incident.responder.added, incident.reassigned, or incident.escalated on one of those services, RansomLeak resolves the responder's work email, assigns the configured module, and emails them a direct link to start it. Assignment is idempotent per incident and responder, and someone who completed the module in the last 30 days is not assigned it again.

What data does the integration read and store?

It reads only the incident id an event references and the responder or assignee work email. The incident body, title, and any other field are never persisted beyond dispatch. The only outbound calls are to the RansomLeak assignment API and the PagerDuty REST API, both over TLS, and no per-user data beyond the work email leaves your tenant.

Does it need read-only or read/write access, and why?

Read/write. The app uses PagerDuty's OAuth with the single write scope, which is the scope an App Directory app can request. Write access is needed for exactly two calls: creating the Webhooks v3 subscription when you connect, and posting the completion note on the incident. The only read is the responder's work email, since the incident id arrives in the signed webhook itself. Access is also capped by the PagerDuty role of the person who authorizes, so connect with an Admin or Account Owner. RansomLeak never creates, edits, acknowledges, or resolves incidents.

Does completion write back to the incident?

Yes. When the assigned module is completed, RansomLeak posts a note on the originating incident, naming the module, the user, and the date, so the evidence sits on the incident timeline. The note uses the same OAuth connection, and each completion posts at most once, so a retried job never double-posts.

How do I uninstall it?

Disconnecting in RansomLeak removes the Webhooks v3 subscription on the PagerDuty side and forgets the stored tokens. If you revoke the app inside PagerDuty instead, RansomLeak detects it on the next token refresh and clears the local connection automatically.