Connect PagerDuty to RansomLeak

Overview

RansomLeak for PagerDuty turns a security incident into a teaching moment. When an incident is routed to a responder, RansomLeak assigns that person a short five to ten minute module and posts completion back on the incident as a note, so the coaching and its evidence live where the response already happens.

You install it once from PagerDuty, and it runs on its own from then on:

• An incident routes to a responder
• A five to ten minute module is assigned
• Completion posts back as an incident note
• Idempotent, so it never assigns twice

Install in one click

An admin connects from RansomLeak. Authorizing grants the four least-privilege scopes below, and RansomLeak creates the webhook subscription for you, so there is nothing to configure on each incident.

1. In RansomLeak, go to Settings → Integrations → PagerDuty and select Connect.

2. You are redirected to PagerDuty for consent using Scoped OAuth 2.0. Sign in and approve the requested scopes.

3. RansomLeak stores the OAuth tokens encrypted and creates a Webhooks v3 subscription pointed at its receiver.

4. Pick which RansomLeak module is assigned when an incident routes to a responder. That is the whole setup.

Events it handles

RansomLeak subscribes to three Webhooks v3 incident events. On each one, it resolves the responder's work email, assigns the configured module, and emails them a direct link to start it.

• incident.responder.added
• incident.reassigned
• incident.escalated

Completion write-back

When the assigned module is completed, RansomLeak posts a note on the originating incident, so the evidence sits on the timeline next to the rest of the response:

The write-back uses the same OAuth connection, so there is no second credential to manage, and the incident.annotated event confirms the note landed. The post is idempotent, so a retried or duplicate completion never double-posts.

Permissions and data handling

The integration is read-light and least-privilege. It reads only the specific incident fields it needs to identify the affected employee, and never stores the incident body.

• Tokens and webhook secret encrypted at rest
• Deliveries verified with HMAC-SHA256
• Disconnect removes the subscription and tokens

Frequently asked questions

Does RansomLeak integrate with PagerDuty?

Yes. You install the RansomLeak app once from PagerDuty using Scoped OAuth 2.0, and from then on, when a security incident is routed to a responder, RansomLeak assigns that person a short five to ten minute security module and records completion back on the incident as a note. There is no per-incident wiring and no script to host.

How does an incident assign training?

On install, RansomLeak creates a Webhooks v3 subscription on your account and you pick which module is assigned. When PagerDuty fires incident.responder.added, incident.reassigned, or incident.escalated, RansomLeak resolves the responder's work email, assigns the configured module, and emails them a direct link to start it. Assignment is idempotent per incident and responder, so repeated or edited events never assign twice.

What data does the integration read and store?

It reads only the incident id an event references and the responder or assignee work email. The incident body, title, and any other field are never persisted beyond dispatch. The only outbound calls are to the RansomLeak assignment API and the PagerDuty REST API, both over TLS, and no per-user data beyond the work email leaves your tenant.

What OAuth scopes does it request?

Four, all least-privilege: incidents.read to read the incident an event references, incidents.write to post the completion note, users.read to resolve the responder's work email, and webhook_subscriptions.write to create the event subscription on install. The OAuth tokens and the per-subscription webhook signing secret are encrypted at rest.

Does completion write back to the incident?

Yes. When the assigned module is completed, RansomLeak posts a note on the originating incident, naming the module, the user, and the date, so the evidence sits on the incident timeline. The note uses the same OAuth connection, the incident.annotated event confirms it landed, and the post is idempotent, so a retried completion never double-posts.

How do I uninstall it?

Disconnecting in RansomLeak removes the Webhooks v3 subscription on the PagerDuty side and forgets the stored tokens. If you revoke the app inside PagerDuty instead, RansomLeak detects it on the next token refresh and clears the local connection automatically.