Step-by-step: Integrating Cato alerts into our PagerDuty workflow.

We had a gap. Cato's SASE platform threw security alerts, but they weren't hitting our on-call rotation in PagerDuty. Had to close that loop.

Here's the webhook integration we built. Cato's Event Forwarding sends to a small AWS Lambda, which formats and pushes to PagerDuty.

Key Lambda function (Python):

```python
import json
import os
import requests

PD_EVENTS_URL = "https://events.pagerduty.com/v2/enqueue"
INTEGRATION_KEY = os.environ['PD_INTEGRATION_KEY']

def lambda_handler(event, context):
for cato_alert in event.get('alerts', []):
payload = {
"routing_key": INTEGRATION_KEY,
"event_action": "trigger",
"payload": {
"summary": f"Cato: {cato_alert.get('eventType', 'Alert')}",
"severity": map_severity(cato_alert.get('severity')),
"source": cato_alert.get('sourceName', 'Cato'),
"custom_details": cato_alert
}
}
requests.post(PD_EVENTS_URL, json=payload)
return {"statusCode": 200}

def map_severity(cato_sev):
sev_map = {"Critical": "critical", "High": "error", "Medium": "warning", "Low": "info"}
return sev_map.get(cato_sev, "info")
```

Cato side: In the management console, set up Event Forwarding to this Lambda's API Gateway endpoint. Filter for the alert types you need (e.g., Threat Prevention, Anomaly).

Lessons:
* The Lambda gives you a place to filter noise before PagerDuty.
* Map Cato's severities to PD's four levels explicitly.
* Test with real low-severity alerts first.

cg