Slack, Microsoft Teams and PagerDuty

From the Solo plan, alerts can go to Slack and Microsoft Teams as rich messages: a title, the score and the findings by severity, what is new, and buttons that open the report in Perimetry. From the Agency plan, PagerDuty receives only what should wake someone up. All three are set up on the Alerts page, in Slack, Microsoft Teams and PagerDuty, by owners and admins.

Slack

1. Open Alerts, then Slack.
2. Press Add to Slack when it is offered: Slack asks which channel to post to, and you come back to Perimetry with the channel added. We keep only the address of that channel, encrypted.
3. Or create an incoming webhook in Slack yourself (api.slack.com/apps → Create New App → Incoming Webhooks → add one for the channel) and paste its address, which starts with https://hooks.slack.com/services/.
4. Choose when to send after an audit and, on the Agency plans, the client, then press Add the Slack channel.
5. Press Test on its line: a test message arrives in the channel.

A Slack address added as a plain webhook gets the same rich messages.

Microsoft Teams

Microsoft has retired the Office 365 connectors and their incoming webhooks: Teams now receives webhooks through a workflow.

1. In the Teams channel, open … → Workflows → Send webhook alerts to a channel (or create a flow that starts with When a Teams webhook request is received and posts the Adaptive Card it receives).
2. Copy the address the workflow gives: it is on logic.azure.com or powerplatform.com.
3. In Perimetry, open Alerts, then Microsoft Teams, paste it, choose when to send, and press Add the Teams channel.
4. Press Test: an Adaptive Card arrives, with a button that opens Perimetry.

PagerDuty

1. In PagerDuty, open the service that should receive the alerts → Integrations → Add an integration → Events API V2, and copy its integration key (32 characters).
2. In Perimetry, open Alerts, then PagerDuty, paste the key, choose the service region (United States or Europe, as your PagerDuty account) and what opens an alert: critical findings or high and critical findings. Outages always do.
3. Press Add PagerDuty, then Test: an event is opened and closed at once, so nobody is called for nothing.

What happens next:

• After each audit, an alert opens for each critical (or high) finding of the domain, once: it is not opened again while it stays open. Ten at most per audit.
• When a later audit no longer finds it, or counts it as an accepted risk (the audit that follows the acceptance), the alert is resolved by itself. Removing the domain or the channel, turning the channel off, or a plan without PagerDuty closes the open alerts too.
• When a site goes down, an alert opens; when it answers again, it is resolved.

PagerDuty receives nothing else: no score changes, no low findings.

Security

Webhook addresses and integration keys are stored encrypted and used only to send the alerts and the tests. Only the ends of a PagerDuty key are shown. Removing a channel deletes them.