Skip to content

Slack, PagerDuty & OpsGenie

Three channels you can wire up under Integrations → Alerts & Tickets to get findings out of the CredWatch portal and into the tools your team already lives in.

Channel Plan Use for
Slack Starter+ Day-to-day visibility, channel-wide awareness
PagerDuty Growth+ Page on-call for high-severity validated findings
OpsGenie Growth+ Same as PagerDuty but for OpsGenie shops

You can enable any combination simultaneously.

Slack

CredWatch posts to Slack via incoming webhook — no OAuth app, no installation flow.

Set up

  1. In Slack: Apps → Incoming WebHooks → Add to Slack. Pick the channel you want.
  2. Copy the webhook URL (https://hooks.slack.com/services/T…/B…/…).
  3. In CredWatch: Integrations → Alerts & Tickets → Slack Notifications, paste the webhook URL, click Save Webhook.
  4. Click Send test message — a CredWatch message should appear in your channel.

What you'll see

  • Immediate alert — one message per validated finding scoring ≥ 80. Includes service name, masked credential, source link, score, validation status.
  • Daily digest — every morning at 08:00 UTC, a summary of yesterday's validated findings.
  • Resolution notification — when a finding is resolved (manually or auto), a green check-in message.

PagerDuty

PagerDuty integration uses Events API v2 with deduplication by finding ID — re-firing the same alert won't open a duplicate incident.

Set up

  1. In PagerDuty: create a new service for CredWatch (or use an existing one).
  2. Add an integration: CredWatch → Events API v2.
  3. Copy the Integration Key (routing key).
  4. In CredWatch: Integrations → Alerts & Tickets → Incident Alerting → PagerDuty, paste the routing key, click Connect PagerDuty.
  5. To verify the integration is wired correctly, the easiest path is to wait for the next validated finding with composite_score ≥ 90 — there is no built-in "send test" button for PagerDuty. If you want to force a test, temporarily lower the immediate-alert threshold or trigger a manual scan.

What pages

Only the highest-severity findings page on-call:

  • composite_score ≥ 90, AND
  • validation_status = valid (confirmed live), AND
  • status = active (not already resolved or suppressed)

These thresholds are deliberately conservative — paging is for things that truly need a human in the next 15 minutes.

When you resolve the finding in CredWatch — manually, via the API, or auto-resolved by a web rescan — CredWatch sends a matching event_action: "resolve" to PagerDuty, keyed by the same dedup_key (credwatch-{finding_id}). The corresponding incident closes automatically. Marking a finding as a false positive or customer_restricted also closes the incident, since the customer has acknowledged the exposure. Delivery is fire-and-forget — a transient PagerDuty outage won't block your resolve action; in the rare case the close event drops, the orphan incident can be closed manually.

OpsGenie

Same model as PagerDuty, different vendor. CredWatch hits the Alerts API v2 with alias-based dedup.

Set up

  1. In OpsGenie: Integrations → Add API Integration → Generic API Integration.
  2. Copy the API Key.
  3. In CredWatch: Integrations → Alerts & Tickets → Incident Alerting → OpsGenie, paste the API key, click Connect OpsGenie.
  4. EU region: also set OPSGENIE_API_URL=https://api.eu.opsgenie.com/v2/alerts (your operator will need to update the env if your account is EU-region).
  5. As with PagerDuty, there is no dedicated "send test" button for OpsGenie — the integration fires automatically on the next validated finding with composite_score ≥ 90.

What alerts

Same thresholds as PagerDuty: score ≥ 90 + valid + active. OpsGenie uses an alias (credwatch-{finding_id}) for deduplication — re-triggers update the existing open alert rather than creating duplicates.

When you resolve the finding in CredWatch, CredWatch calls OpsGenie's POST /v2/alerts/credwatch-{finding_id}/close?identifierType=alias so the alert closes automatically. False-positive and customer_restricted resolutions close the alert the same way. Delivery is fire-and-forget; OpsGenie's 422 already closed response is treated as success so the close call is idempotent.

Email alerts

Email is always on for every plan, no setup required. Manage which addresses receive alerts under Organisation → Notifications → Alert Emails:

  • Add as many addresses as you need (there's currently no hard cap, but keep the list focused — every address receives every alert).
  • Each address receives both immediate alerts and the daily digest.
  • Remove an address by clicking the × next to it.

Quietening alerts

If you're getting too many alerts:

  1. Raise the immediate-alert threshold via your operator (env: IMMEDIATE_ALERT_SCORE).
  2. Use suppression rules to silence noisy patterns or test fixtures.
  3. Mark recurring false positives so the underlying pattern can be improved.