Webhook integration is available for enterprise plans only.
You can create a custom webhook that receives Intezer Protect events and forward those events to another application such as SIEM, ticket management, or custom app.
The following Intezer Protect events can be exported via webhook:
- Alerts
Overview
After configuring the webhook, when Intezer Protect generates an alert, it automatically sends that alert to the URL endpoint you configure in the webhook. Intezer Protect sends an HTTP POST request with the payload in json format as shown in the following example:
{
"alert_id": "a4cb1a5d-2b4e-4b58-b292-2f6ae612a550",
"alert_type": "malicious_code",
"severity": "high",
"alert_details": {
"family": "XMrig"
},
"assets": [
{
"asset_id": "236d33ed-e274-43dc-9572-2dc89948b6c5",
"hostname": "aks-workers-123456-vmss000000"
}
],
"created_at": "2021-02-17T14:50:33.819137"
"alert_url": "https://protect.intezer.com/da724875-b0da-4912-872d-e9ec51d122c0/alerts/a4cb1a5d-2b4e-4b58-b292-2f6ae612a550"
}
The following table describes Intezer Protect payload elements:
Field Name | Description | Type | Possible Values |
alert_id | A unique identifier for the alert | string (uuid) | |
alert_type | The type of the alert | string |
malicious_code fileless_malware suspicious_command |
severity | The severity of the alert | string |
low medium high severe |
alert_details.family | The associated malware family in case of a malware attack. Available only in malicious_code and fileless_malware alerts | string | |
alert_details.command | The suspicious command triggered opening the alert. Available only in suspicious_command alert | string | |
assets_details | A list of assets relevant to the alert opened | array | |
asset_details.asset_id | A unique identifier of the asset | string (uuid) | |
asset_details.hostname | The hostname of the asset | string | |
created_at | An iso8601 format string of the time when the alert was created (in UTC) | string | |
alert_url | A url that opens the alert in Intezer Protect | string |
Set up the Integration
Please contact us at support@intezer.com in order to set up a webhook integration and for further assistance.