AdministrationAlerts

Send Alerts to a webhook

A generic HTTP webhook channel POSTs each Alert as JSON to an HTTPS endpoint you control. The Teams and Slack channels format Alerts as chat messages; a webhook sends the JSON for you to route into your own systems.

For the shared Alerts model and how to create Alert rules, see Set up Alerts.

Add a webhook channel

1

Open Alerts and add a channel

In the Admin panel, open Alerts under the Setup group. Under External channels, click Add channel and set the channel type to Webhook.

The Alerts page showing the External channels and Alert rules sections, with the Add channel button
Adding a channel from the Alerts page
2

Enter the channel details

Fill in the Webhook channel fields:

  • Channel Label: a display name for this destination in the External channels list, such as SIEM Ingest or Incident Intake. It is cosmetic and does not affect the payload.
  • Webhook URL: the full HTTPS endpoint Method posts the Alert JSON to. This can be any endpoint you control, such as a SIEM webhook collector, an internal relay or serverless function, an automation or workflow platform, or an incident-management intake URL.
  • HTTP Headers: zero or more key/value pairs added to every outbound POST, added with + Add header. Covered in the next step.
New Target Channel form set to Webhook, with a Channel Label of System Web Hook, a Webhook URL field, and an HTTP Headers section with an Add header button
The Webhook channel form
3

Add authentication headers

Authentication goes in HTTP Headers. Click + Add header and add the key/value pair the receiving system expects, for example Authorization set to Bearer <token>, or X-Api-Key set to your key. Add a header for every value the endpoint requires.

Webhook channel form with an HTTP header added: Authorization set to a Bearer token, with a delete control beside it
Adding an Authorization header to the webhook channel
4

Save the channel

Click Add. The webhook appears in the External channels list and is ready to receive Alerts.

External channels list showing the System Web Hook Webhook channel connected
The connected webhook channel in External channels

Once the channel is connected, create an Alert rule to route events to it.