Remediate PagerDuty Alert

Take remediation actions based on the incident event type.

If run with flowpipe server, this mod will receive a PagerDuty v3 webhook event when an incident is triggered, annotated, and acknowledged.


Download and install Flowpipe ( Or use Brew:

brew tap turbot/tap
brew install flowpipe


git clone
cd incident_response/remediate_pagerduty_alert

Install mod dependencies:

flowpipe mod install


By default, the following environment variables will be used for authentication:


You can also create credential resources in configuration files:

vi ~/.flowpipe/config/pagerduty.fpc
credential "pagerduty" "pagerduty_cred" {
api_key = "u+_szhL..."

For more information on credentials in Flowpipe, please see Managing Credentials.


Run the pipeline to take action for PagerDuty incident acknowledged:

flowpipe pipeline run pagerduty_incident_acknowledged --arg incident_id=PT4KHLK

To run whenever an incident is triggered, annotated, and acknowledged, start the Flowpipe server:

flowpipe server

Once started, Flowpipe will run the pipeline automatically whenever a webhook event is received.


To run the pipeline automatically whenever a webhook event is received, you can create a PagerDuty webhook subscription.

To configure the webhook subscription in PagerDuty:

  1. Get the trigger details:
    flowpipe trigger show http.pagerduty_webhook_incident_events
  2. Copy the Url, e.g., /hook/remediate_pagerduty_alert.trigger.http.pagerduty_webhook_incident_events/92ffeda03426754f2c79dfaa
  3. Use a tool like ngrok with a custom domain to expose your localhost server to the internet:
    ngrok http 7103
  4. Form the full webhook URL with the public endpoint from ngrok and the trigger URL using the format https://{ngrok_domain}{hook_url}, e.g.,
  5. Create the webhook subscription in PagerDuty with the following configurations:
    • Webhook URL: <URL from above>
    • Scope Type: Account
    • Description: Flowpipe webhook trigger
    • Event Subscription:
      • incident.acknowledged
      • incident.triggered
      • incident.annotated