Make exposed-secret alerts impossible to miss
A leaked credential is time-sensitive. Notis can turn GitHub secret scanning alerts into PagerDuty incidents before they become another item lost in the queue.
Trigger
New Secret Scanning Alert Detected
Triggers when a new secret scanning alert is detected in a GitHub repository. Monitors open secret scanning alerts and fires an event for each newly detected alert. Supports filtering by secret type (e.g., personal access tokens, AWS keys) and by token validity status (active, inactive, unknown). The payload includes the alert number, secret type, validity status, resolution state, timestamps, URLs, and flags for push protection bypass, public exposure, and multi-repo detection.
Action
Create incident record
Creates a new incident in pagerduty with specified details and assignments. use this endpoint when an event requires immediate attention from on-call teams. it supports comprehensive incident documentation, including priority, urgency, and conference bridge information. the 'incident key' parameter helps prevent duplicate incidents, crucial for maintaining a clean incident list.
Why this helps
Responding to credential exposure requires urgency, but founders may not see the GitHub alert until much later.
- Shorten time to credential-response work
- Create an auditable incident record
- Keep urgent security tasks out of ordinary issue queues
Setup
Build it in a few focused steps.
- 1Connect GitHub and PagerDuty to Notis once through the portal.
- 2Create the automation in the portal or ask Notis for it in plain language.
- 3Use this instruction: When GitHub detects a new secret scanning alert, create a PagerDuty incident with the secret type, validity status, repository, and alert link.
- 4Pick the GitHub secret scanning trigger, select the run-report channel, and test with one real alert.
Questions about this workflow
Can it distinguish active secrets?
Yes. Include the desired validity status in the instruction, such as active or unknown.
Will it delete or revoke the secret?
No. This workflow creates the PagerDuty incident so your response process starts immediately.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link GitHub to Pagerduty. A trigger fires from one place; an action lands in another.
GitHub triggers
Pagerduty actions
New Workflow Artifact Created
Triggers when a new workflow artifact is created in a GitHub repository. Monitors for newly created GitHub Actions workflow artifacts. Optionally filters by artifact name to restrict monitoring to specific artifacts.
Add service to incident workflow trigger
This endpoint adds a service to an existing incident workflow trigger in pagerduty. it allows you to associate a specific service with a trigger, enabling automated incident management processes for that service. use this endpoint when you need to connect a service to an incident workflow, typically during the setup or modification of your incident response procedures. the endpoint requires the trigger's id and the service's id to make the association. it's important to note that this operation doesn't create new services or triggers, but rather links existing ones. ensure that both the trigger and service exist in your pagerduty account before making this call.
Branch Changed
Triggers when a GitHub branch changes. Monitors a specific branch for: - New commits pushed (head commit SHA changes) - Protection status toggled (branch becomes protected or unprotected) - Protection settings changed, including: required status checks and their enforcement level, admin enforcement, required pull request reviews (dismiss stale reviews, code owner reviews, approving review count, last push approval), required linear history, force push allowance, deletion allowance, conversation resolution, branch locking, and fork syncing.
Aggregate escalation policy incident metrics
This endpoint analyzes and aggregates incident metrics across all escalation policies in pagerduty. it allows for detailed filtering and customization of the analysis, enabling users to gain insights into incident patterns, response times, and escalation effectiveness. the endpoint is particularly useful for operational reviews, performance analysis, and identifying areas for improvement in incident management processes. it provides flexibility in data selection through various filters and supports different time-based aggregations for comprehensive reporting.
New Branch Created
Triggers when a new branch is created in a GitHub repository. Detects newly created branches. Deleted branches do not fire events.
Associate service dependencies
Associates multiple service dependencies in pagerduty, allowing you to define relationships between supporting and dependent services. this endpoint is used to establish a hierarchical structure of services, which is crucial for effective incident management and impact analysis. it enables you to create multiple dependencies in a single api call, improving efficiency when setting up complex service relationships. use this endpoint when you need to define or update the dependency structure of your services in pagerduty, such as during initial setup, service restructuring, or when adding new services to your incident management workflow.
Check Run Status / Conclusion Changed
Triggers when a specific GitHub check run changes its status or conclusion. Monitors a single check run for changes to: status (queued, in_progress, completed, etc.), conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required), started_at, and completed_at.
Associate team with automation action
This endpoint associates a specific team with an automation action in pagerduty. it allows you to link a team to an automated workflow, enabling better organization and management of automation actions within your incident response processes. use this endpoint when you need to assign responsibility for an automation action to a particular team or when restructuring your automation workflows. the association helps in tracking, auditing, and managing permissions for automation actions across different teams in your organization. note that this endpoint only creates the association; it does not create new teams or automation actions.
Check Suite Status / Conclusion Changed
Triggers when a GitHub check suite changes its status or conclusion for a given ref. Monitors all check suites associated with a git reference (branch, tag, or commit SHA) for changes to status (queued, in_progress, completed, etc.) and conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required, startup_failure, stale). Optionally filters by GitHub App ID.
Audit escalation policy records
Retrieves the audit records for a specific escalation policy in pagerduty. this endpoint allows users to access a detailed history of changes made to the escalation policy, including modifications to escalation rules, associated services, and on-call schedules. it's particularly useful for compliance tracking, troubleshooting, and understanding how the incident response process has been adjusted over time. the audit records provide transparency into who made changes, what was changed, and when the changes occurred, helping teams maintain accountability and optimize their incident management workflows.
New Code Scanning Alert Created
Triggers when a new code scanning alert is created in a repository. Fires an event for each newly created code scanning alert detected in the configured repository. Alerts can be filtered by Git reference, scanning tool, state, and severity. The payload includes the alert number, rule details, tool information, state, severity, and the location of the most recent instance.
Convert service rule by id
Converts the rules associated with a specific pagerduty service to a new or optimized format. this endpoint is used to update and standardize the incident management rules for a given service, improving the efficiency and consistency of alert handling. it should be used when there's a need to modernize rule sets, apply best practices, or adapt rules to changing service requirements. the conversion process is applied to all rules linked to the specified service id, potentially modifying their structure or behavior. it's important to note that this operation may impact existing incident routing and alerting patterns, so it should be used cautiously and preferably during a maintenance window.
New Repository Collaborator Added
Triggers when a new collaborator is added to a GitHub repository. Monitors the full list of collaborators on a repository and fires an event for each newly added collaborator. The payload includes the collaborator's GitHub username, account ID, profile URL, avatar URL, permission flags (pull, triage, push, maintain, admin), and assigned role name.
Count paused incident reports
Retrieves the count of paused incident reports in the pagerduty system. this endpoint is part of pagerduty's incident management and analytics features, providing a quick way to quantify the number of incidents that are currently in a paused state. it's particularly useful for generating high-level analytics, tracking incident management efficiency, and identifying trends in incident handling. the endpoint returns a simple count, making it ideal for dashboard displays or periodic system status checks. it should be used when a rapid overview of paused incidents is needed, but it won't provide detailed information about individual incidents.
Commit Event
Triggered when a new commit is pushed to a repository.
Create a custom field for an incident type
Create a custom field for an incident type. custom fields (cf) are a feature which will allow customers to extend incidents with their own custom data, to provide additional context and support features such as customized filtering, search and analytics. custom fields can be applied to different incident types. <!-- theme: warning --> > ### early access > this endpoint is in early access and may change at any time. you must pass in the x-early-access header to access it. scoped oauth requires: `custom fields.write`
Connect any two apps with Notis in the middle.
Not just GitHub and Pagerduty. Any combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7 days free trial with 20$ free usage included.
No card. Works with personal or business Pagerduty.