OpsGenie Playbook Setup

Issue

A Playbook was configured to generate OpsGenie Alerts whenever a Threat was published in Red Canary.  While testing the Playbook, the Customer kept receiving the same error message: "OpsGenie::API::ResponseError."  This error was not helpful because it did not provide the actual HTTP error code, so it was not clear if the problem was on the Customer's side or Red Canary's side. 

Environment

Red Canary Playbooks/Automate

Resolution

This ended up being a misconfiguration on the OpsGenie side.  

The setup for the OpsGenie Playbook is very simple.  All it really requires is a valid/activated API Key. 

Here are the steps to configure the API key on the OpsGenie side: 

1. Login to OpsGenie and open the "Teams" tab. 

2. Select the correct Team that you want to be Alerted (Example: "Security")

3. Click on the Integrations tab > then click "Add Integration" 

4. Search for "API" and select the API tile

5. Give your API Integration a descriptive name and hit "Continue." 

6.  Finally, copy the API Key to your clipboard or save it someplace safe, then click on the "Turn on Integration" button.  You should see the "Status" setting showing that it's "ON." 

Lastly, setup the Playbook with the correct API Key and Priority setting. 

Here's an example of what the Configuration should look like: