Configure Integration for Incidents

1. Select IncidentsIncidentsNotification Profiles.
2. Click + Create Notification Profile.
3. Enter a Profile Name.
4. Select Integration and enter the Integration Name.

5. Enter the URL of your external tool set.
6. Choose an Auth Type:
   • None
   • Basic: Enter a username and password.
   • Bearer token: Enter the token value.
7. (Optional) In the Webhook Signing Secret field, Generate Secret. Strata Cloud Manager generates a cryptographic signing secret and displays it in cleartext. If a secret already exists, the field displays a masked value. See Create Notification Profiles for Incidents.
8. Enable Include Associated Events to get all updates related to an incident excluding the initial trigger and resolution. See Associated Events Email Notifications.
9. Under Field mapping, you have two options:
   • Import from JSON
     Copy an example JSON payload from the destination tool's developer documentation and paste it here. Strata Cloud Manager parses the fields, infers their types, and builds the field list automatically.
   • Add manually
     Choose a source Strata Cloud Manager field and enter the corresponding destination field. Add fields based on your requirements.
   Make sure that all the fields are mapped.
10. Under Test & Activate, click Preview Payload to review the exact JSON that Strata Cloud Manager would send, using a synthetic incident. All mapping rules and static values are applied. No network call is made at this step.
11. When the payload looks correct, Send Test. Strata Cloud Manager creates a synthetic incident, applies the compiled mapping rules, sends the payload to the destination URL, and displays the result.
12. Click Save Profile. You can save your profile at any time to preserve your progress as a draft and finish configuring it later. If all required fields and mappings are fully configured, the integration becomes Active; otherwise, it remains saved in a Draft state until configuration is complete.

Example: PagerDuty Integration

• routing_key: The integration key from your PagerDuty service or global event orchestration rule. Enter this as a static custom field value in the Strata Cloud Manager notification profile.
• event_action: The action to perform. For raise events from Strata Cloud Manager, always set this to the static value trigger. The resolve lifecycle is handled by a PagerDuty event orchestration rule, not by changing this value in Strata Cloud Manager. See Resolve Lifecycle below.
• payload.summary: A human-readable description of the event. Map this to the Strata Cloud Manager field title.
• payload.source: The source of the event. Map this to the Strata Cloud Manager field details_link to link directly to the Strata Cloud Manager incident detail page.
• payload.severity: The severity of the event. Must be one of the following exact values (case-sensitive): critical, warning, error, or info. You need to set this as a static custom field value.

Resolve Lifecycle for PagerDuty

1. In PagerDuty, navigate to your service's Event Orchestration rules and create a new rule.
2. In Step 1: When should this rule be applied?, set the condition to: event.custom_details.status matches Cleared.

3. In Step 2: What action(s) should be applied?, under Alert Data, select Always resolve an alert. Optionally, set the alert severity to info for cleared events.

4. Save the rule. PagerDuty automatically resolves any open alert whose dedup_key matches an incoming event where event.custom_details.status is Cleared.

Sample Payloads

{
  "routing_key": "<your-pagerduty-routing-key>",
  "event_action": "trigger",
  "dedup_key": "test_incident_id",
  "client": "test_tenant_service_group",
  "payload": {
    "summary": "Test Integration",
    "severity": "critical",
    "source": "test_details_link",
    "custom_details": {
      "title": "Test Integration",
      "status": "test_status",
      "tenant": "test_tenant_id",
      "incident_id": "test_incident_id",
      "raised_time": "2026-09-22 16:33:46.553000 UTC"
    }
  }
}

The following is an example of the payload that Strata Cloud Manager sends when a real incident is raised:

{
  "routing_key": "<your-pagerduty-routing-key>",
  "event_action": "trigger",
  "dedup_key": "74a58d3b-76de-44e8-9060-example",
  "client": "xxxxxxxx",
  "payload": {
    "summary": "ADEM/GP Log Certificate (globalprotect_app_log_cert) to expire on 2026-06-06",
    "severity": "critical",
    "source": "https://stratacloudmanager.paloaltonetworks.com/incidents/details/74a58d3b-76de-44e8-9060-example",
    "custom_details": {
      "title": "ADEM/GP Log Certificate (globalprotect_app_log_cert) to expire on 2026-06-06",
      "status": "Raised",
      "tenant": "xxxxxxx",
      "incident_id": "74a58d3b-76de-44e8-9060-76dfec5c8407",
      "raised_time": "2026-09-22T16:46:16.731068Z"
    }
  }
}

The following screenshot shows the Strata Cloud Manager incident that triggered the PagerDuty alert. The activity log confirms that the external adapter notification was sent to the notification profile:

The following screenshot shows the alert successfully received in PagerDuty, with the dedup_key mapped to the Strata Cloud Manager incident ID and custom details visible in the alert view:

The following screenshot shows the resulting open incident in PagerDuty: