# Webhook

### Overview <a href="#overview" id="overview"></a>

Webhooks can be used to send event data to a third-party app or to your own web server. Every time an event has a state update (start, ongoing, end) Netography will send the the event information to the URL specified.

#### JSON Format <a href="#json-format" id="json-format"></a>

Below is an example of a webhook JSON POST body sent when an event is started.

{% tabs %}
{% tab title="JSON" %}

```
{
   "alerttype":"start",
   "algorithm":"knownbotnet",
   "beta":false,
   "bypassdisplay":false,
   "bypassrule":false,
   "cachekey":"1.2.3.4 7.8.9.10",
   "categories":[
      "iprep"
   ],
   "customer":"<shortname>",
   "description":"Srcip reputation is a known botnet",
   "dstinternal":"",
   "dstip":[

   ],
   "duration":0,
   "end":0,
   "factorcount":"",
   "factors":"",
   "flowsrcname":"",
   "id":"00edee24-bc66-4b37-803c-123456789012",
   "ignore":false,
   "input":"",
   "ipinfo":[

   ],
   "ipinfocount":0,
   "lasttimestamp":0,
   "metrics":{
      "bits":{
         "avg":0.00,
         "max":0,
         "min":0,
         "sum":0
      },
      "bitsxrate":{
         "avg":0.00,
         "max":0,
         "min":0,
         "sum":0
      },
      "clockahead":{
         "avg":0.00,
         "max":0,
         "min":0,
         "sum":0
      },
      "clockbehind":{
         "avg":0.00,
         "max":0,
         "min":0,
         "sum":0
      },
      "count":{
         "flow":1
      },
      "duration":{
         "avg":0.00,
         "max":0,
         "min":0,
         "sum":0
      },
      "hasclock":false,
      "packets":{
         "avg":0.00,
         "max":0,
         "min":0,
         "sum":0
      },
      "packetsxrate":{
         "avg":0.00,
         "max":0,
         "min":0,
         "sum":0
      }
   },
   "name":"",
   "output":"",
   "rollupperiod":300,
   "rulecount":0,
   "rules":null,
   "severity":"medium",
   "site":"",
   "srcinternal":"",
   "srcip":[

   ],
   "start":1689391131,
   "summary":"Knownbotnet alert has started in <location> for device <devicename>",
   "tag":"",
   "tags":[
      "tag1",
      "tag2",
      "tag3"
   ],
   "threshold":"count(track_by) >= 1",
   "timestamp":1689391131,
   "track":"srcip dstip",
   "track_by":[
      "srcip",
      "dstip"
   ],
   "updatecount":1,
   "updateinterval":300
}
```

{% endtab %}
{% endtabs %}

#### Customizing the webhook JSON <a href="#customizing-the-webhook-json" id="customizing-the-webhook-json"></a>

The field names in the webhook can be customized to match fields your webhook service is already looking for. If you need to customize any of the fields in the above JSON, please [contact support](https://support.netography.com).

### Netography Portal Steps <a href="#netography-portal-steps" id="netography-portal-steps"></a>

In **Settings > Response Integrations**, click **Add Integration**. Select **Webhook**

![](/files/lZDHEpPGW3sQHgn7i4jF)

#### Configuration <a href="#configuration" id="configuration"></a>

The following fields are specific to the Webhook integration.

| Field                   | Required | Description                                                                                                                                                                                        | Example                 |
| ----------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
| `URL`                   | yes      | The URL to POST the event JSON to                                                                                                                                                                  |                         |
| `Skip SSL Verification` |          | If checked, the server certificate will not be validated against the available certificate authorities. Also won’t require the URL host name to match the common name presented by the certificate |                         |
| `Headers`               |          | Comma separated list of `header: value` pairs                                                                                                                                                      | `X-Netography: Webhook` |

#### Authentication <a href="#authentication" id="authentication"></a>

The following fields are necessary for the integration to authenticate using HTTP Basic Auth.

| Field      | Required | Description              |
| ---------- | -------- | ------------------------ |
| `Username` | no       | HTTP Basic Auth ID       |
| `Password` | no       | HTTP Basic Auth password |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/automate-responses/configuring-response-integrations/webhook.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.