PagerDuty Foundational Practitioner cheat sheet

Incident lifecycle states: Triggered → Acknowledged → Resolved; escalation policies run until a responder acknowledges, then stop.

An escalation policy is an ordered list of levels, each level containing targets (user, schedule, team, or escalation policy) and a timeout in minutes.

A service binds one escalation policy, one or more integration keys, and optional support hours, urgency rules, and auto-pause settings.

Urgency (high vs. low) determines which notification rules fire: high-urgency incidents notify immediately, low-urgency follow per-user delay rules.

Schedules define ordered rotation layers with restrictions; a user's on-call status derives from layer order plus override entries, which take precedence.

Incident priority is a separate field from urgency: urgency drives notification behavior, priority drives triage ordering and reporting.

Stakeholder updates and status updates publish to subscribers; postmortems attach to resolved incidents and can be exported.

Incident Workflows trigger automated actions on events such as incident creation, priority change, or status change, and can run manual steps.

Merge consolidates duplicate incidents into one primary incident; alerts from merged incidents are re-parented to the primary.

Signal ingestion path: integration receives event → dedup_key groups events into an alert → alert groups into an incident per service.

Event API v2 fields: routing_key, event_action (trigger/acknowledge/resolve), dedup_key, payload (summary, source, severity, custom_details).

Dedup key semantics: same dedup_key within a service updates the existing open alert; omitting dedup_key lets PagerDuty generate one.

Alert grouping settings (time window and grouping type) control whether multiple alerts collapse into one incident.

Event Orchestration evaluates global rulesets before service-level rules, matching on event fields and applying actions like route, suppress, severity, and extract.

Suppression rules drop or hold events; a suppressed event does not create an incident unless later unsuppressed by a matching rule.

Intelligent alert grouping uses machine learning similarity to cluster related alerts; manual grouping uses explicit rules.

Severity levels (critical, error, warning, info) propagate from events to alerts and can be mapped to incident urgency or priority.

Anomaly and event intelligence features surface noise-reduction metrics such as alert-to-incident ratio and auto-resolve rates.

Automation Actions run from an incident (manual or via Incident Workflow) and execute against a runner: Runbook Automation (cloud) or a self-hosted Rundeck/Process Automation node.

Action types include script, command, and process automation job; each action specifies a runner, timeout, and input parameters.

Incident Workflows consist of a trigger, optional conditions, and ordered steps; steps can be actions, tasks, or nested workflow triggers.

Workflow triggers include incident created, priority updated, status changed, and manual invocation.

Event Orchestration is the pre-incident automation layer; Incident Workflows are the post-incident automation layer.

Auto-pause and auto-resolve settings on a service reduce noise by resolving incidents when alerts clear or pausing notifications during maintenance.

Maintenance windows suppress notifications for selected services without altering incident records.

Rundeck-style runners require outbound connectivity or an access key; credentials are stored in the runner, not in the action definition.

The PagerDuty Operations Cloud bundles Incident Response, AIOps, Automation, and Customer Service Operations; the reliability platform layers analytics on top.

Incident Analytics and operational reviews quantify MTTD, MTTA, MTTR, and incident volume by service, team, and urgency.

Postmortem workflows capture contributing factors, action items, and follow-up ownership; action items can be tracked to closure.

Service ownership and service directory data underpin reporting; a service without an owner degrades escalation and analytics accuracy.

Paige is PagerDuty's AI SRE agent: it summarizes incidents, surfaces related past incidents, and suggests next steps from incident context.

Paige outputs are assistive; a human responder remains accountable for acknowledgement, mitigation, and resolution decisions.

SLO and reliability dashboards track error budgets and burn against service objectives where configured.

Health checks and status dashboards report platform component availability separately from customer incident data.

Integration types: native (built-in), global event orchestration integrations, and generic inbound (Events API v2, email) or outbound (webhooks, extensions) integrations.

Every service integration exposes a routing key (integration key); Events API v2 posts to https://events.pagerduty.com/v2/enqueue with that key.

REST API v2 uses token auth (Authorization: Token token=...) with a From header identifying a valid user email.

Webhooks v3 deliver signed payloads; verify the signature header against the subscription secret before trusting the body.

Extensions (v1) support custom incident actions and generic webhooks triggered by incident events.

OAuth 2.0 and scoped API keys restrict app permissions; least-privilege scoping is set at app registration.

Change Events API records deployments and config changes, correlating them with incidents for root-cause analysis.

Common outbound targets: Slack/Teams for chat, Jira for ticketing, and monitoring tools (Datadog, Prometheus/Alertmanager) as inbound sources.

Rate limits apply per endpoint; 429 responses include retry guidance and should be handled with backoff.

Incident lifecycle states: Triggered → Acknowledged → Resolved; escalation policies run until a responder acknowledges, then stop.

An escalation policy is an ordered list of levels, each level containing targets (user, schedule, team, or escalation policy) and a timeout in minutes.

A service binds one escalation policy, one or more integration keys, and optional support hours, urgency rules, and auto-pause settings.

Urgency (high vs. low) determines which notification rules fire: high-urgency incidents notify immediately, low-urgency follow per-user delay rules.

Schedules define ordered rotation layers with restrictions; a user's on-call status derives from layer order plus override entries, which take precedence.

Incident priority is a separate field from urgency: urgency drives notification behavior, priority drives triage ordering and reporting.

Stakeholder updates and status updates publish to subscribers; postmortems attach to resolved incidents and can be exported.

Incident Workflows trigger automated actions on events such as incident creation, priority change, or status change, and can run manual steps.

Merge consolidates duplicate incidents into one primary incident; alerts from merged incidents are re-parented to the primary.

Signal ingestion path: integration receives event → dedup_key groups events into an alert → alert groups into an incident per service.

Event API v2 fields: routing_key, event_action (trigger/acknowledge/resolve), dedup_key, payload (summary, source, severity, custom_details).

Dedup key semantics: same dedup_key within a service updates the existing open alert; omitting dedup_key lets PagerDuty generate one.

Alert grouping settings (time window and grouping type) control whether multiple alerts collapse into one incident.

Event Orchestration evaluates global rulesets before service-level rules, matching on event fields and applying actions like route, suppress, severity, and extract.

Suppression rules drop or hold events; a suppressed event does not create an incident unless later unsuppressed by a matching rule.

Intelligent alert grouping uses machine learning similarity to cluster related alerts; manual grouping uses explicit rules.

Severity levels (critical, error, warning, info) propagate from events to alerts and can be mapped to incident urgency or priority.

Anomaly and event intelligence features surface noise-reduction metrics such as alert-to-incident ratio and auto-resolve rates.

Automation Actions run from an incident (manual or via Incident Workflow) and execute against a runner: Runbook Automation (cloud) or a self-hosted Rundeck/Process Automation node.

Action types include script, command, and process automation job; each action specifies a runner, timeout, and input parameters.

Incident Workflows consist of a trigger, optional conditions, and ordered steps; steps can be actions, tasks, or nested workflow triggers.

Workflow triggers include incident created, priority updated, status changed, and manual invocation.

Event Orchestration is the pre-incident automation layer; Incident Workflows are the post-incident automation layer.

Auto-pause and auto-resolve settings on a service reduce noise by resolving incidents when alerts clear or pausing notifications during maintenance.

Maintenance windows suppress notifications for selected services without altering incident records.

Rundeck-style runners require outbound connectivity or an access key; credentials are stored in the runner, not in the action definition.

The PagerDuty Operations Cloud bundles Incident Response, AIOps, Automation, and Customer Service Operations; the reliability platform layers analytics on top.

Incident Analytics and operational reviews quantify MTTD, MTTA, MTTR, and incident volume by service, team, and urgency.

Postmortem workflows capture contributing factors, action items, and follow-up ownership; action items can be tracked to closure.

Service ownership and service directory data underpin reporting; a service without an owner degrades escalation and analytics accuracy.

Paige is PagerDuty's AI SRE agent: it summarizes incidents, surfaces related past incidents, and suggests next steps from incident context.

Paige outputs are assistive; a human responder remains accountable for acknowledgement, mitigation, and resolution decisions.

SLO and reliability dashboards track error budgets and burn against service objectives where configured.

Health checks and status dashboards report platform component availability separately from customer incident data.

Integration types: native (built-in), global event orchestration integrations, and generic inbound (Events API v2, email) or outbound (webhooks, extensions) integrations.

Every service integration exposes a routing key (integration key); Events API v2 posts to https://events.pagerduty.com/v2/enqueue with that key.

REST API v2 uses token auth (Authorization: Token token=...) with a From header identifying a valid user email.

Webhooks v3 deliver signed payloads; verify the signature header against the subscription secret before trusting the body.

Extensions (v1) support custom incident actions and generic webhooks triggered by incident events.

OAuth 2.0 and scoped API keys restrict app permissions; least-privilege scoping is set at app registration.

Change Events API records deployments and config changes, correlating them with incidents for root-cause analysis.

Common outbound targets: Slack/Teams for chat, Jira for ticketing, and monitoring tools (Datadog, Prometheus/Alertmanager) as inbound sources.

Rate limits apply per endpoint; 429 responses include retry guidance and should be handled with backoff.

Incident lifecycle states: Triggered → Acknowledged → Resolved; escalation policies run until a responder acknowledges, then stop.

An escalation policy is an ordered list of levels, each level containing targets (user, schedule, team, or escalation policy) and a timeout in minutes.

A service binds one escalation policy, one or more integration keys, and optional support hours, urgency rules, and auto-pause settings.

Urgency (high vs. low) determines which notification rules fire: high-urgency incidents notify immediately, low-urgency follow per-user delay rules.

Schedules define ordered rotation layers with restrictions; a user's on-call status derives from layer order plus override entries, which take precedence.

Incident priority is a separate field from urgency: urgency drives notification behavior, priority drives triage ordering and reporting.

Stakeholder updates and status updates publish to subscribers; postmortems attach to resolved incidents and can be exported.

Incident Workflows trigger automated actions on events such as incident creation, priority change, or status change, and can run manual steps.

Merge consolidates duplicate incidents into one primary incident; alerts from merged incidents are re-parented to the primary.

Signal ingestion path: integration receives event → dedup_key groups events into an alert → alert groups into an incident per service.

Event API v2 fields: routing_key, event_action (trigger/acknowledge/resolve), dedup_key, payload (summary, source, severity, custom_details).

Dedup key semantics: same dedup_key within a service updates the existing open alert; omitting dedup_key lets PagerDuty generate one.

Alert grouping settings (time window and grouping type) control whether multiple alerts collapse into one incident.

Event Orchestration evaluates global rulesets before service-level rules, matching on event fields and applying actions like route, suppress, severity, and extract.

Suppression rules drop or hold events; a suppressed event does not create an incident unless later unsuppressed by a matching rule.

Intelligent alert grouping uses machine learning similarity to cluster related alerts; manual grouping uses explicit rules.

Severity levels (critical, error, warning, info) propagate from events to alerts and can be mapped to incident urgency or priority.

Anomaly and event intelligence features surface noise-reduction metrics such as alert-to-incident ratio and auto-resolve rates.

Automation Actions run from an incident (manual or via Incident Workflow) and execute against a runner: Runbook Automation (cloud) or a self-hosted Rundeck/Process Automation node.

Action types include script, command, and process automation job; each action specifies a runner, timeout, and input parameters.

Incident Workflows consist of a trigger, optional conditions, and ordered steps; steps can be actions, tasks, or nested workflow triggers.

Workflow triggers include incident created, priority updated, status changed, and manual invocation.

Event Orchestration is the pre-incident automation layer; Incident Workflows are the post-incident automation layer.

Auto-pause and auto-resolve settings on a service reduce noise by resolving incidents when alerts clear or pausing notifications during maintenance.

Maintenance windows suppress notifications for selected services without altering incident records.

Rundeck-style runners require outbound connectivity or an access key; credentials are stored in the runner, not in the action definition.

The PagerDuty Operations Cloud bundles Incident Response, AIOps, Automation, and Customer Service Operations; the reliability platform layers analytics on top.

Incident Analytics and operational reviews quantify MTTD, MTTA, MTTR, and incident volume by service, team, and urgency.

Postmortem workflows capture contributing factors, action items, and follow-up ownership; action items can be tracked to closure.

Service ownership and service directory data underpin reporting; a service without an owner degrades escalation and analytics accuracy.

Paige is PagerDuty's AI SRE agent: it summarizes incidents, surfaces related past incidents, and suggests next steps from incident context.

Paige outputs are assistive; a human responder remains accountable for acknowledgement, mitigation, and resolution decisions.

SLO and reliability dashboards track error budgets and burn against service objectives where configured.

Health checks and status dashboards report platform component availability separately from customer incident data.

Integration types: native (built-in), global event orchestration integrations, and generic inbound (Events API v2, email) or outbound (webhooks, extensions) integrations.

Every service integration exposes a routing key (integration key); Events API v2 posts to https://events.pagerduty.com/v2/enqueue with that key.

REST API v2 uses token auth (Authorization: Token token=...) with a From header identifying a valid user email.

Webhooks v3 deliver signed payloads; verify the signature header against the subscription secret before trusting the body.

Extensions (v1) support custom incident actions and generic webhooks triggered by incident events.

OAuth 2.0 and scoped API keys restrict app permissions; least-privilege scoping is set at app registration.

Change Events API records deployments and config changes, correlating them with incidents for root-cause analysis.

Common outbound targets: Slack/Teams for chat, Jira for ticketing, and monitoring tools (Datadog, Prometheus/Alertmanager) as inbound sources.

Rate limits apply per endpoint; 429 responses include retry guidance and should be handled with backoff.