We're evaluating Akamai Prolexic for DDoS mitigation. Their portal is fine, but our on-call engineers live in PagerDuty. Having critical alerts stuck in a separate vendor UI is a non-starter for our incident response.
Has anyone built a direct integration from Prolexic alerts into PagerDuty? I'm not talking about a generic webhook that dumps JSON into a PD email address. I need actionable, deduplicated incidents with meaningful payloads.
Key questions:
* Is there a native integration, or did you have to build a custom middleware (Lambda, webhook server)?
* How did you handle alert routing? For example, separating volumetric attack alerts from malicious packet flood alerts.
* What's in your payload? We need at minimum:
* Attack vector classification
* Target IP/range
* Peak bandwidth/pps
* Mitigation status (started, ongoing, stopped)
* How are you preventing alert fatigue for sustained attacks? A single attack shouldn't spawn 100 PD incidents.
If you built it, I'd like to see your transformer logic. A simple Python snippet or PD V2 event adapter would be helpful.
--monitor
alert only when it matters
No native integration that we found. We built a Lambda function to parse their webhook and format for PagerDuty's V2 Events API.
Key part was the deduplication logic. Used the Akamai incident ID as the `dedup_key` so updates wouldn't create new incidents. For routing, we check the `attack_vector` field in the Prolexic JSON and set the PagerDuty routing key accordingly.
Here's a snippet of our transform, mostly just mapping fields:
```python
def prolexic_to_pd(payload):
pd_payload = {
"routing_key": ROUTING_KEYS.get(payload.get('attack_type'), 'default_key'),
"event_action": "trigger",
"dedup_key": payload['incident_id'],
"payload": {
"summary": f"Prolexic: {payload['attack_vector']} on {payload['target_ip']}",
"source": "akamai-prolexic",
"severity": "critical",
"custom_details": {
"target": payload['target_ip'],
"peak_bps": payload.get('peak_bandwidth_bps'),
"mitigation_status": payload.get('mitigation_status'),
"vector": payload['attack_vector']
}
}
}
return pd_payload
```
How are you handling the alert fatigue part? We still get a lot of state updates during an attack.
No native integration. We did the same Lambda approach as user316, but with a few extra steps.
Biggest issue: Prolexic's webhook payload is inconsistent. Sometimes `target_ip` is an array, sometimes a single string. We had to add normalization. Also, their "mitigation status" field often lags by 5-10 minutes.
Our payload includes the fields you listed, plus the Akamai correlation ID for their support.
Alert fatigue: we dedupe on `incident_id` and only trigger a new PagerDuty incident if the previous one is resolved. For ongoing attacks, we use the `event_action: trigger` only once, then `event_action: acknowledge` for updates.
```python
def transform_event(raw_event):
# Normalize the target field
target = raw_event.get('target_ip', 'N/A')
if isinstance(target, list):
target = ', '.join(target[:3]) # Limit to first 3 IPs
pd_event = {
"dedup_key": raw_event['incident_id'],
"payload": {
"summary": f"{raw_event['attack_vector']} - {target}",
"custom_details": {
"peak_bps": raw_event.get('peak_bps'),
"peak_pps": raw_event.get('peak_pps'),
"status": raw_event.get('mitigation_status'),
"vector": raw_event['attack_vector']
}
}
}
return pd_event
```
Routing: we map `attack_vector` to PD service keys. Volumetric goes to network team, L7 floods go to app team. Anything with "DNS" goes to infra.
latency kills