Fluid Attacks' webhooks are not compatible with Google Chat and Slack.

Notice that the Webhooks card displays how many of the groups you have access to have this integration configured.

Understand the Add hooks table

The table in the Add hooks pop-up window displays the endpoints you have configured to receive notifications for events you are interested in. Each column is explained below.

• Name: Name to refer to the webhook
• Url: The designated endpoint to which notifications are transmitted upon the occurrence of a specified event action
• Token header: The header containing your token for the URL
• Events: The list of events of which notifications are sent when they occur in the group

Events available for webhooks

Events refer to the actions of the platform of which you can receive notifications when they occur in your specific group. The following are the events for which you can set up webhooks:

• AGENT_TOKEN_EXPIRATION: The DevSecOps agent token is about to expire.
• ENVIRONMENT_REMOVED: An environment is removed from the Scope section
• EVENT_CREATED: An event is created in the group
• ROOT_CREATED: A new root is added in the Scope section
• ROOT_DISABLED: A root is deactivated
• VULNERABILITY_ASSIGNED: A vulnerability is assigned to a member of the group
• VULNERABILITY_CREATED: A vulnerability is reported to the group
• VULNERABILITY_DELETED: A vulnerability is deleted due to the realization of a reporting error, or because it was a duplicate or identified as a false positive
• VULNERABILITY_SEVERITY_CHANGED: The severity score is changed
• VULNERABILITY_VERIFIED: A request is sent to see the status of the reattack
  

{
  "group": "group_name",
  "event": "event",
  "info": {}
}

{
  "group_data": {
    "org_name",
    "exp_date",
  }
}

{
  "url_id",
  "root_id",
}

{
  "event_id",
}

{
  "type",
  "root_id",
}

{
  "root_id",
}

{
  "vulnerabilities",
  "finding_id",
  "responsible",
}

{
  "finding_id",

  "finding_title",
  "group_name",

  "severity_score",

  "severity_score_v4",

  "vulnerability_id",
  "vulnerability_specific",

  "vulnerability_where",
}

{
  "finding_id",
}

{
  "finding_id",
  "vulns_id",
}

{}

Manage your webhooks

Role required: User Manager

• Add hook
• Edit
• Remove

Add a webhook

1. Access your organization's Integrations section, click on the gear in the Webhooks card and then on the option next to the group for which you wish to set up the webhook. 

2. Click on the Add hook button.
   

   

3.  Fill out the Add hook information pop-up window. The fields are explained below the screenshot.

   

   • Url: The URL of the endpoint of the hook where you want to receive event notifications.
   • Name: The name or alias of the webhook.
   • Token header: The header containing the token for that URL (this field is optional and defaults to the x-API-token value)
     
   • Token: The security token needed to access the URL
   • Events: Actions specific to the group for which you wish to receive notifications (select at least one; see the definitions of events available for webhooks above)
     

4. Once all the fields are filled out, click on Confirm. It is advisable to validate that the endpoint is accessible by making a request.

Edit a webhook

To modify the information of a specific webhook already created for a group, follow these steps:

1. Access your organization's Integrations section, click on the gear in the Webhooks card and then on the option next to the group for which you wish to modify a webhook. 

2. Select the webhook and then click the Edit button.
   

   

3. In the new pop-up window, modify the configuration of the webhook as needed. (Read the descriptions of these fields from the instructions to add a webhook.) 

   

4. After making changes, click Confirm to save them. It is advisable to validate that the endpoint is accessible by making a request.

Remove a webhook

To remove a webhook that is no longer of interest to you, follow these steps:

1. Access your organization's Integrations section, click on the gear in the Webhooks card and then on the option next to the group for which you wish to delete a webhook. 

2. Choose the webhook and then click on the Remove button.

   

3. A confirmation window pops up asking you to confirm that you want to delete the webhook. Upon clicking Confirm, the webhook is removed from the table.

   

Error messages

When you add or edit a webhook on Fluid Attacks' platform, the webhook is subjected to specific validations. You have to keep these validations in mind when performing those actions. If your webhook does not pass one or more checks, you get the corresponding error message(s). The following are the error messages you may get: 

• Invalid data: The URL and/or the token are not valid.
• Duplicated: You attempted to add a URL that already exists.
• Unreached Host: The host URL was not found.
• Not Found: The hook has not been found, or you do not have permission to access it.