Webhooks

Configure in Settings → Integrations → Webhook. Each event category gets a POST to your endpoint:

POST https://your-app.example/monsys
Content-Type: application/json
X-Monsys-Signature: hmac-sha256(<secret>, body)

{
  "event":     "alert.created",
  "tenant_id": "...",
  "agent_id":  "...",
  "alert": {
    "id":        "...",
    "severity":  "critical",
    "category":  "honeypot",
    "title":     "Honeypot tripped: /root/.ssh/id_rsa.monsys-backup",
    "created_at":"2026-05-09T12:42:18Z"
  }
}

Verification

import hmac, hashlib

def verify(secret: bytes, body: bytes, signature: str) -> bool:
    mac = hmac.new(secret, body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, signature)

Event types

Event	When
alert.created	An alert is created
alert.resolved	An alert is resolved
agent.online	Agent has come online
agent.offline	Heartbeat-silence ≥ 90 s
honeypot.tripped	Canary activated
cve.match.new	New CVE-match (CVSS ≥ 7.0)
emergency.token.issued	Token issued (audit)