JupiterOne Webhook icon

JupiterOne Webhook

Listen for JupiterOne rule alerts and security events

JupiterOne Webhook

AI-generated

Overview

This node listens for incoming JupiterOne webhook events, specifically rule alerts and security events. It supports optional authentication via a header token to verify the webhook's authenticity. Upon receiving a valid webhook payload, it extracts relevant event details such as rule name, severity, trigger time, query data, query results, and entities, then outputs this structured data for further workflow processing. This node is useful for automating responses or logging based on JupiterOne security alerts.

Use Case Examples

  1. Automatically trigger a workflow when a JupiterOne security rule is triggered.
  2. Log JupiterOne alert details into a database for audit purposes.
  3. Send notifications based on the severity of JupiterOne alerts.

Properties

Name Meaning
Authentication Method to authenticate incoming webhooks, either none or via a header token.
Webhook Secret Secret token used to verify webhook authenticity when header token authentication is selected.
Header Name Name of the HTTP header that contains the authentication token for webhook verification.

Output

JSON

  • ruleName - Name of the JupiterOne rule that triggered the alert, defaults to 'Unknown Rule' if not provided.
  • severity - Severity level of the alert, defaults to 'UNKNOWN' if not provided.
  • triggeredAt - Timestamp when the rule was triggered, defaults to current time if not provided.
  • timestamp - Timestamp when the webhook was processed.
  • queryData - Optional data related to the query that triggered the alert.
  • queryResults - Optional results of the query that triggered the alert.
  • totalResults - Total number of results in the query results, if available.
  • entities - Array of entities related to the alert, if provided.
  • totalEntities - Count of entities included in the alert data.

Troubleshooting

  • Missing authentication header results in a 401 Unauthorized error with a message indicating the missing header name.
  • Invalid authentication token results in a 401 Unauthorized error with a message indicating an invalid token.
  • Invalid webhook payload (not an object) results in a 400 Bad Request error with a message indicating an invalid payload.

Discussion