Generic webhooks

Our generic webhooks integration (alert) allows you to subscribe to notifications for select Next-Gen WAF activity types.

Adding a webhook integration (alert)

To add a webhook integration (alert), complete the following steps:

Notifications format

Notifications are sent with the following format:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

{
  "created": "2024-02-09T21:08:21.31644377Z",
  "type": "flag",
  "payload": {
      "ID": "abcde123456789",
      "CorpID": "123456789abcde",
      "SiteID": "987654321fedcba",
      "Scope": "site",
      "Slug": "site.example",
      "Name": "example",
      "Description": "Webhook integration for Example site",
      "CreatedBy": "admin@example.com",
      "CreatedByID": "edcba987654321",
      "Created": "2024-02-09T21:08:21.31644377Z",
      "Updated": "2025-01-07T21:06:31.50725289Z",
      "ResourceID": "ASDFghjkl123456789"
  },
  "link":"dashboard link to event",
  "workspaceId": "www.mysite.com"
}

X-SigSci-Signature header

All requests sent from the generic webhook integration (alert) contain a header called X-SigSci-Signature. The value is an HMAC-SHA256 hex digest hashed using a signing key generated when the generic webhook was created.

To rotate the signing key, complete the following steps:

Verification is done by creating an HMAC-SHA256 hex digest of the generic webhook payload using the signing key and comparing the result to the value of the X-SigSci-Signature header.

X-SigSci-Signature header verification example code

The examples show header verification code for X-SigSci-Signature.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
)

// CheckMAC reports whether messageMAC is a valid HMAC tag for message.
func CheckMAC(message, messageMAC, key []byte) bool {
    mac := hmac.New(sha256.New, key)
    mac.Write(message)
    expectedMAC := mac.Sum(nil)

    return hmac.Equal(messageMAC, expectedMAC)
}

func main() {
    key := []byte("[insert signing key here]")

    h := "[insert X-SigSci-Signature value here]"

    json := []byte(`[insert JSON payload here]`)

    hash, err := hex.DecodeString(h)
    if err != nil {
        log.Fatal("ERROR: ", err)
    }

    ok := CheckMAC(json, hash, key)

    fmt.Println(ok)
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

import hashlib
import hmac

def checkHMAC(message, messageMAC, key):
    mac = hmac.new(key, message, digestmod=hashlib.sha256).hexdigest()

    return mac == messageMAC

key = '[insert signing key here]'

h = '[insert X-SigSci-Signature value here]'

json = '[insert JSON payload here]'

ok = checkHMAC(json, h, key)

print(ok)

1
2
3
4
5
6
7
8
9
10

require 'openssl'
require "base64"

key = '[insert signing key here]'
h = '[insert X-SigSci-Signature value here]'
json = '[insert JSON payload here]'

hash  = OpenSSL::HMAC.hexdigest('sha256', key, json)

puts hash == h

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

#!/bin/bash

function check_hmac {
  json="$1"
  messageMAC="$2"
  key="$3"

  result=$(echo -n "$json" | openssl dgst -sha256 -hmac "$key")
  if [ "$result" == "$messageMAC" ]
  then
          return 0
  else
          return 1
  fi
}

key='[insert key here]'
h='[insert X-SigSci-Signature value here]'
json='[insert JSON payload here]'

check_hmac "$json" $h $key

Activity types

When setting up a webhook integration (alert) in the Next-Gen WAF control panel, you can select from the following activity types:

Related content

• Using an API with the Next-Gen WAF