​

Notifications

​

Webhook Overview

• Alert fired - New detection triggered
• Alert status changed - Status updated
• System events - Health alerts, rule changes

​

Configuring Webhooks

​

Create a Webhook

1. Navigate to Settings > Notifications
2. Click Add Webhook
3. Configure the webhook
4. Save and test

​

Webhook Settings

​

Payload Formats

​

JSON (Generic)

{
  "event": "alert.created",
  "timestamp": "2024-01-15T14:32:17Z",
  "alert": {
    "id": "abc-123",
    "rule_title": "Failed Login Attempt",
    "severity": "medium",
    "status": "new",
    "matched_at": "2024-01-15T14:32:15Z"
  },
  "rule": {
    "id": "def-456",
    "title": "Failed Login Attempt",
    "severity": "medium"
  },
  "context": {
    "source_ip": "192.168.1.50",
    "user": "admin",
    "host": "SERVER01"
  }
}

​

Slack Format

{
  "text": "🚨 Alert: Failed Login Attempt",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*Failed Login Attempt*\nSeverity: Medium\nSource: 192.168.1.50"
      }
    },
    {
      "type": "actions",
      "elements": [
        {
          "type": "button",
          "text": {"type": "plain_text", "text": "View Alert"},
          "url": "https://chad.example.com/alerts/abc-123"
        }
      ]
    }
  ]
}

​

Discord Format

{
  "content": "🚨 Security Alert",
  "embeds": [
    {
      "title": "Failed Login Attempt",
      "color": 16744448,
      "fields": [
        {"name": "Severity", "value": "Medium", "inline": true},
        {"name": "Source IP", "value": "192.168.1.50", "inline": true}
      ],
      "timestamp": "2024-01-15T14:32:17Z"
    }
  ]
}

​

Setting Up Slack

​

Create Incoming Webhook

1. Go to your Slack workspace settings
2. Navigate to Apps > Manage > Custom Integrations
3. Click Incoming Webhooks
4. Click Add to Slack
5. Choose a channel
6. Copy the webhook URL

​

Configure in CHAD

1. Add webhook with Slack URL
2. Select Slack format
3. Choose events to notify
4. Test the webhook

​

Setting Up Discord

​

Create Webhook

1. Open Discord server settings
2. Go to Integrations > Webhooks
3. Click New Webhook
4. Name it and choose channel
5. Copy the webhook URL

​

Configure in CHAD

1. Add webhook with Discord URL
2. Select Discord format
3. Choose events
4. Test

​

Per-Rule Notifications

​

Disable Webhook per Rule

1. Open the rule
2. Click Settings
3. Disable Send to webhook
4. Save

​

Severity Filtering

1. Edit the webhook
2. Set Minimum Severity
3. Only alerts at or above this level trigger notifications

​

Custom Headers

Authorization: Bearer your-api-token
X-Custom-Header: your-value

​

Webhook Signing

1. Set a Secret in webhook config
2. CHAD includes X-CHAD-Signature header
3. Verify signature in your endpoint

HMAC-SHA256(secret, request_body)

​

Retry Logic

​

Event Types

​

Testing Webhooks

1. Click Test on the webhook
2. CHAD sends a test payload
3. Verify receipt in your system

​

Monitoring Webhooks

1. Go to Settings > Notifications
2. Click the webhook
3. View Delivery Log
4. See success/failure history

​

Troubleshooting

​

Webhook not firing

1. Check webhook is enabled
2. Verify event type is selected
3. Check rule has notifications enabled
4. Review delivery log for errors

​

Authentication errors

1. Verify URL is correct
2. Check custom headers
3. Test endpoint with curl

​

Timeout errors

1. Your endpoint may be slow
2. Webhook timeout is 30 seconds
3. Optimize your endpoint

​

Invalid payload

1. Check format matches endpoint expectations
2. Try generic JSON format
3. Verify field mappings

​

Best Practices

​

Next Steps