• Alerts

Forwards matched events to a third-party service as a customizable JSON payload through an HTTP POST request. For example, you can use a webhook connection to create a ServiceNow ticket after Security Analytics triggers an alert. To set up a webhook connection:

• Navigate to Manage  > Alerting > Alert Rules.

• Click Add.

• Configure the following alert specifications:

  • Name and description

  • Search type — Saved Search or Custom search

  • Event time range

  • Alert schedule

  • Alert trigger condition

  • Throttle conditions

• Set Alert Actions: Add a new webhook alert action, by providing the following information:

  • Select Webhook as the action.

  • Specify the URL to send the JSON payload through an HTTP POST request.

  • (Optional) Provide an Authorization Header.

  • (Optional) Provide any Custom Header.

  • Enter the Payload the webhook will share in JSON format.

  • Select Trigger for every match to make a single call for every alert trigger and for the third-party service to send one webhook call for each match in the results set.

  • Click Save.

• Click Save to finish creating the alert.

• Here's an example of the JSON payload customization:

			
The user configures an alert for the search query: eventlog | fields event_time, sourcetype, action, user | limit 10
				
			
 You can configure the JSON payload while setting up the webhook connection as follows:
			

				
Option 1: Trigger for every match unselected
{
	"alert": "My event log alert",
	"time": "{{events[0].event_time}}",               # Get the value of the field 'event_time' from the first record
	"source_type": "{{events[1].sourcetype}}",        # Get the value of the field 'sourcetype' from the second record
	"user": "{{events[2].user}}"                      # Get the value of the field 'user' from the third record
}
				
				
Option 2: Trigger for every match selected (that is, a separate call per trigger)
{
	"alert": "My event log alert",
	"time": "{{event.event_time}}",            
	"source_type": "{{event.sourcetype}}",     
	"user": "{{event.user}}"
}