Pagerduty Analytics
You set up pagerduty analytics by turning on reporting permissions and assigning user roles. This feature tracks alert volume, response speed, and fix times across your team. Most teams start by giving all managers broad read roles across every service. They also create API keys so external tools can pull raw incident data. Broad permissions let users see alert trends, but they create security risks. Shared API keys and wide roles expose sensitive incident details to too many people. How page
User Behavior Analytics (UBA/UEBA) + PagerDuty Integration Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up pagerduty analytics by turning on reporting permissions and assigning user roles. This feature tracks alert volume, response speed, and fix times across your team.
Most teams start by giving all managers broad read roles across every service. They also create API keys so external tools can pull raw incident data. Broad permissions let users see alert trends, but they create security risks. Shared API keys and wide roles expose sensitive incident details to too many people.
How pagerduty analytics works in your setup
The reporting engine collects event timestamps every time an alert fires in your account. It logs when an alert starts, when someone claims it, and when it closes. From those logs, the system builds metrics for response speed and fix time.
Admins control who sees these reports through base roles and team rules. You can limit a user to one team or grant account-wide read rights. Teams also pull this data through the REST API for custom dashboards. To do this, an admin creates an API token with read permissions. The analytics app then uses that token to fetch incident history on a schedule.
What native reporting solves and what it misses
Native reporting shows you which services fail most often and which teams need help. It helps leaders balance on-call loads and reduce alert fatigue across the company. Base roles also do a good job of controlling who logs into the web app.
Still, alert payloads and incident notes often hold private customer data. When an alert fires, the log might contain emails, phone numbers, or card numbers. Anyone with analytics read rights or an API key can pull those raw records. Native roles only check who logs in to view the dashboard. They do not filter sensitive fields out of API responses or query results.
User Behavior Analytics (UBA/UEBA) + PagerDuty Integration Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
The same gap appears when responders jump from an alert to fix a server. Pagerduty logs that an engineer took the call, not what commands they ran next. Once the engineer opens a database session, the incident tool loses visibility. Standing database keys and broad server roles leave every live command unchecked.
How to tighten security around incident data and response
Start by auditing who holds account-wide read roles and active API keys. Remove global tokens and use scoped keys that only read the endpoints you need. Keep customer emails, phone numbers, and national IDs out of raw alert titles. Configure your monitoring tools to send short error codes instead of full user records.
Next, close the gap between claiming an alert and running fixes on production hosts. Do not give on-call staff standing admin keys for databases and cloud servers. Tie every database query and server command back to the active incident ticket. Check every command in flight and rewrite sensitive data fields in query results.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What metrics does Pagerduty track by default?
The platform tracks incident count, time to claim an alert, and time to resolve it. It also measures on-call hours, high-urgency alert volume, and responder interruptions per shift.
Who can view incident reports and team metrics?
Account owners, global admins, and users with observer or manager roles can view reports. Team-level roles can also see metrics if admins enable team visibility in settings.
How do teams export incident metrics to external tools?
Teams use the REST API or built-in webhooks to send incident logs to external stores. Admins generate a read-only API key so reporting scripts can fetch historical data.