Event-Driven Webhooks

How It Works

CyberVault's webhook engine monitors your security posture and automatically pushes structured JSON payloads to your configured endpoints when predefined events trigger. Delivery is guaranteed with retry logic, signature verification, and idempotency tracking.

Supported Events

Currently, the beta supports 12 core event types. Additional enterprise and compliance events are scheduled for v1.0.

Quick Start

1. Create an Endpoint URL

   Ensure your server accepts POST requests at a publicly accessible HTTPS URL. The endpoint must respond with a 200 OK or 201 Created status code within 5 seconds.

2. Configure in Dashboard

   Navigate to Settings → Integrations → Webhooks. Click Add Webhook, paste your URL, and select the events you want to subscribe to.

3. Verify & Test

   Toggle Enable Verification to receive a test payload. Validate the X-CyberVault-Signature header before processing the request.

Sample Payload

Every webhook request includes a standard envelope with metadata and the event-specific data object.

{
  "id": "wh_8f3a2b9c-1e4d-5f6a-7b8c-9d0e1f2a3b4c",
  "event": "threat.detected",
  "timestamp": "2025-01-15T14:32:00Z",
  "data": {
    "threat_id": "thr_94x2k1",
    "severity": "critical",
    "source_ip": "203.0.113.42",
    "target_asset": "prod-db-01.cybervault.internal",
    "vector": "sql_injection",
    "confidence": 0.98,
    "mitre_id": "T1190"
  },
  "metadata": {
    "workspace_id": "ws_5501",
    "engine_version": "ai_v3.1",
    "idempotency_key": "idm_x9z8y7w6"
  }
}

Security & Verification

All webhook payloads are signed using HMAC-SHA256. Verify the signature using your webhook secret before processing:

// Node.js Verification Example
const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  const digest = hmac.update(payload).digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(digest), 
    Buffer.from(signature)
  );
}