--- title: Generic webhooks summary: null url: >- https://www.fastly.com/documentation/guides/next-gen-waf/integrations/generic-webhooks --- Our generic webhooks integration (alert) allows you to subscribe to notifications for select Next-Gen WAF activity types. > **HINT:** > > Want to set up alerting for your CDN or Compute service? Check out our [Observability](/guides/observability/alerts/about-alerts/) guides. > > > ## Adding a webhook integration (alert) To add a webhook integration (alert), complete the following steps: ### Next Gen Waf Control Panel 1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net). 2. From the **Sites** menu, select a site if you have more than one site. 3. From the **Manage** menu, select **Site Integrations**. 4. Click **Add site integration**. 5. Select the **Generic Webhook** integration. 6. In the **Webhook URL** field, enter a URL to receive the notifications at. 7. Select if you want to be alerted regarding **All activity** or **Specific activity**. If you selected **Specific activity**, then in the **Activity** menu choose the activity types that you want the integration to create alerts for. 8. Click **Create site integration**. ### Fastly Control Panel 1. Log in to the [Fastly control panel](https://manage.fastly.com). 2. Go to **Security** > **Next-Gen WAF** > [**Workspaces**](https://manage.fastly.com/security/ngwaf/workspaces). 3. Click the gear Gear icon next to the workspace that you want to modify. 4. Click **Alerts** and then **Add alert**. 5. Fill out the **Add alert** form as follows: - From the **Integration type** menu, select **Webhook**. - In the **Webhook URL** field, enter a URL to receive the notifications at. - In the **Select activities** menu, leave **Flagged IPs** checked. 6. Click **Add workspace alert**. ## Notifications format Notifications are sent with the following format: ```json { "created": "2024-02-09T21:08:21.31644377Z", "type": "flag", "payload": { "ID": "abcde123456789", "CorpID": "123456789abcde", "SiteID": "987654321fedcba", "Scope": "site", "Slug": "site.example", "Name": "example", "Description": "Webhook integration for Example site", "CreatedBy": "admin@example.com", "CreatedByID": "edcba987654321", "Created": "2024-02-09T21:08:21.31644377Z", "Updated": "2025-01-07T21:06:31.50725289Z", "ResourceID": "ASDFghjkl123456789" }, "link":"dashboard link to event", "workspaceId": "www.mysite.com" } ``` ## X-SigSci-Signature header All requests sent from the generic webhook integration (alert) contain a header called `X-SigSci-Signature`. The value is an HMAC-SHA256 hex digest hashed using a signing key generated when the generic webhook was created. To rotate the signing key, complete the following steps: ### Next Gen Waf Control Panel 1. Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net). 2. From the **Sites** menu, select a site if you have more than one site. 3. From the **Manage** menu, select **Site Integrations**. 4. Click the name of the appropriate generic webhook integration. 5. Click **Rotate**. 6. _(Optional)_ Click **Reveal** to see the full value of the signing key. ### Fastly Control Panel 1. Log in to the [Fastly control panel](https://manage.fastly.com). 2. Go to **Security** > **Next-Gen WAF** > [**Workspaces**](https://manage.fastly.com/security/ngwaf/workspaces). 3. Click the gear Gear icon next to the workspace that you want to modify. 4. Click **Alerts**. 5. Click the pencil Pencil icon next to the appropriate alert. 6. Click **Rotate**. > **HINT:** After clicking **Rotate**, you do not need to click **Update workspace alert** to save the new signing key. 7. _(Optional)_ Click **Reveal** to see the full value of the signing key. Verification is done by creating an HMAC-SHA256 hex digest of the generic webhook payload using the signing key and comparing the result to the value of the `X-SigSci-Signature` header. ## X-SigSci-Signature header verification example code The examples show header verification code for `X-SigSci-Signature`. ### Go ```go package main import ( "crypto/hmac" "crypto/sha256" "encoding/hex" "fmt" ) // CheckMAC reports whether messageMAC is a valid HMAC tag for message. func CheckMAC(message, messageMAC, key []byte) bool { mac := hmac.New(sha256.New, key) mac.Write(message) expectedMAC := mac.Sum(nil) return hmac.Equal(messageMAC, expectedMAC) } func main() { key := []byte("[insert signing key here]") h := "[insert X-SigSci-Signature value here]" json := []byte(`[insert JSON payload here]`) hash, err := hex.DecodeString(h) if err != nil { log.Fatal("ERROR: ", err) } ok := CheckMAC(json, hash, key) fmt.Println(ok) } ``` ### Python ```python import hashlib import hmac def checkHMAC(message, messageMAC, key): mac = hmac.new(key, message, digestmod=hashlib.sha256).hexdigest() return mac == messageMAC key = '[insert signing key here]' h = '[insert X-SigSci-Signature value here]' json = '[insert JSON payload here]' ok = checkHMAC(json, h, key) print(ok) ``` ### Ruby ```ruby require 'openssl' require "base64" key = '[insert signing key here]' h = '[insert X-SigSci-Signature value here]' json = '[insert JSON payload here]' hash = OpenSSL::HMAC.hexdigest('sha256', key, json) puts hash == h ``` ### Bash ```bash #!/bin/bash function check_hmac { json="$1" messageMAC="$2" key="$3" result=$(echo -n "$json" | openssl dgst -sha256 -hmac "$key") if [ "$result" == "$messageMAC" ] then return 0 else return 1 fi } key='[insert key here]' h='[insert X-SigSci-Signature value here]' json='[insert JSON payload here]' check_hmac "$json" $h $key ``` ## Activity types > **IMPORTANT:** This section only applies to Next-Gen WAF customers with access to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net). When setting up a webhook integration (alert) in the Next-Gen WAF control panel, you can select from the following activity types: | Activity type | Description | Payload | | ------------------------------ | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `siteDisplayNameChanged` | The display name of a site (workspace) was changed | | | `siteNameChanged` | The short name of a site (workspace) was changed | | | `loggingModeChanged` | The agent mode (`Blocking`, `Not Blocking`, `Off`) was changed | [Get site by name](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__get) | | `agentAnonModeChanged` | The agent IP anonymization mode was changed | [Get site by name](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__get) | | `flag` | An IP address was flagged | [Get event by ID](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__events__eventID__get) | | `expireFlag` | An IP address flag was manually expired | [List events](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__events_get) | | `createCustomRedaction` | A custom redaction was created | [Create a custom redaction](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__redactions_post) | | `removeCustomRedaction` | A custom redaction was removed | [Remove a custom redaction](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__redactions__id__delete) | | `updateCustomRedaction` | A custom redaction was updated | [Update a custom redaction](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__redactions__id__patch) | | `customTagCreated` | A custom signal was created | | | `customTagUpdated` | A custom signal was updated | | | `customTagDeleted` | A custom signal was removed | | | `customAlertCreated` | A custom alert was created | [Create a custom alert](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__alerts_post) | | `customAlertUpdated` | A custom alert was updated | [Update a custom alert](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__alerts__id__patch) | | `customAlertDeleted` | A custom alert was removed | [Remove a custom alert](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__alerts__id__get) | | `detectionCreated` | A templated rule was created | | | `detectionUpdated` | A templated rule was updated | | | `detectionDeleted` | A templated rule was removed | | | `listCreated` | A list was created | [Create a list](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__lists_post) | | `listUpdated` | A list was updated | [Update a list](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__lists__id__patch) | | `listDeleted` | A list was removed | [Remove a list](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__lists__id__delete) | | `ruleCreated` | A request rule was created | | | `ruleUpdated` | A request rule was updated | | | `ruleDeleted` | A request rule was deleted | | | `customDashboardCreated` | A custom dashboard was created | | | `customDashboardUpdated` | A custom dashboard was updated | | | `customDashboardReset` | A custom dashboard was reset | | | `customDashboardDeleted` | A custom dashboard was removed | | | `customDashboardWidgetCreated` | A custom dashboard card was created | | | `customDashboardWidgetUpdated` | A custom dashboard card was updated | | | `customDashboardWidgetDeleted` | A custom dashboard card was removed | | | `agentAlert` | An agent alert was triggered | | ## Related content - [Using an API with the Next-Gen WAF](https://www.fastly.com/documentation/guides/next-gen-waf/developer/using-an-api-with-the-next-gen-waf)