PagerDuty integration
Page your on-call team from Maskflare
- Request blocked and File blocked, as severity error
- Malicious file, as severity critical
- Block spike, Device unprotected, API key expiring and Issue reported, as severity warning
- Other events you tick are sent as severity info
Some events should wake someone up: a malicious file sent to an AI provider, or a sudden spike in blocked requests. Maskflare has a PagerDuty destination type that triggers an alert through the Events API v2.
Each delivery becomes one alert with a severity, a summary, a few metadata fields and a link to the console. A retry of the same delivery does not create a second alert.
What it does
- Request blocked and File blocked, as severity error
- Malicious file, as severity critical
- Block spike, Device unprotected, API key expiring and Issue reported, as severity warning
- Other events you tick are sent as severity info
Set up PagerDuty with Maskflare
Maskflare triggers a PagerDuty alert per event through the Events API v2, using a service's integration key.
- In PagerDuty, open Services, Service Directory, and select the service to alert (or create one). On its Integrations tab, select Add another integration, choose Events API V2 and select Add.
- Copy the Integration Key from the Events API V2 integration.
- In the Maskflare console, open Connections, then Integrations and select Add endpoint.
- Set Destination to PagerDuty. The URL is https://events.pagerduty.com/v2/enqueue. Paste the key into Integration (routing) key. It is stored encrypted and never shown again.
- Under Events, tick only the events worth a page, such as Request blocked, Malicious file and Block spike. Every ticked event triggers an alert. Request processed is not available for PagerDuty.
- Select Add endpoint, then Done, and use Send test event on the endpoint row to check an alert is created.
What data is shared
- Each alert has a summary, a severity, the source maskflare followed by your organization, the event type as the component, a timestamp, and custom details with a fixed list of metadata fields.
- A link opens the matching page in the Maskflare console.
- Never sent: prompts, responses, file names or contents, detected values, the free-text description of an issue report, a person's email address or the details of a configuration change.
Good to know
- Choose events deliberately. Info-level events such as Config changed still trigger an alert when ticked.
- Each alert uses a deduplication key made from the delivery, so a retry updates the same alert.
- Maskflare sends trigger events only. Resolving the incident is done in PagerDuty.
Vendor documentation
Frequently asked questions
Which PagerDuty integration do I need?
An Events API V2 integration on a service. Its Integration Key goes into the Integration (routing) key field in Maskflare.
What severity do alerts get?
Blocked requests and files are errors, a malicious file is critical, a few operational events are warnings, and anything else is info.
Can PagerDuty receive every request?
No. Request processed is not available for PagerDuty.
Do alerts contain prompts?
No. They contain metadata fields and counts, never prompts or detected values.
Other siem and alerting integrations
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →