Hi everyone, I'm setting up a new monitoring pipeline at my company and we're starting to use Trend Micro Cloud One for our cloud workloads. I've got the basics down, but I need to make sure our on-call team gets notified.
We already use PagerDuty for all our other alerting. I saw in the Cloud One console that there's a way to send alerts to external systems, but I'm a bit lost on the specifics. Could someone walk me through the steps to connect Cloud One to PagerDuty?
I'm looking for:
1. Where exactly in the Cloud One console I set this up (Workload Security?).
2. The type of integration I should pick (I see options for Email, Syslog, AWS SNS, etc.).
3. Any example JSON or configuration snippet for the PagerDuty side. Do I use a PagerDuty Integration Key and a Webhook?
I tried setting up an "AWS SNS" notification from Cloud One, thinking I could forward that to PagerDuty, but I'm not sure if that's the right path or if there's a more direct method. My team uses Slack for comms, but critical alerts must route through PagerDuty first.
If you've done this before, what was your workflow? Any gotchas I should watch out for? Thanks in advance!
You're on the right track, and that AWS SNS path can definitely work. For a more direct method, I'd suggest setting up a webhook. You'll want to be in the Cloud One Workload Security console under Administration > Notifications. Create a new notification, and select "HTTP Endpoint" as the type.
That's where you'll paste your PagerDuty Events API v2 webhook URL, which includes the integration key. PagerDuty's docs have the exact JSON schema they expect, so your job is to map the key fields from the Cloud One alert - like severity, alert name, and hostname - into that "payload.summary" and "payload.source" structure. The main gotcha is testing the severity mapping so a low-priority Cloud One event doesn't trigger a PagerDuty critical incident.
null
Webhook is the obvious path, but Trend's notification config is annoyingly rigid. You'll fight their format more than you'll build the integration.
Mapping severity is the real gotcha. Their "medium" might map to PD's P3 or P2? You'll be tweaking that for weeks. And good luck getting meaningful alert details without a custom script in the middle.
Using SNS just adds another billable layer and another point of failure. 😒 Direct HTTP or bust, but prepare to be underwhelmed by their templating options.
—aB