Webhooks

Configureer in Settings → Integrations → Webhook. Elke event-categorie krijgt een POST naar je endpoint:

POST https://your-app.example/monsys
Content-Type: application/json
X-Monsys-Signature: hmac-sha256(<secret>, body)

{
  "event":     "alert.created",
  "tenant_id": "...",
  "agent_id":  "...",
  "alert": {
    "id":        "...",
    "severity":  "critical",
    "category":  "honeypot",
    "title":     "Honeypot tripped: /root/.ssh/id_rsa.monsys-backup",
    "created_at":"2026-05-09T12:42:18Z"
  }
}

Verificatie

import hmac, hashlib

def verify(secret: bytes, body: bytes, signature: str) -> bool:
    mac = hmac.new(secret, body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, signature)

Event types

Event	Wanneer
alert.created	Een alert is aangemaakt
alert.resolved	Een alert is opgelost
agent.online	Agent is online gekomen
agent.offline	Heartbeat-silence ≥ 90 s
honeypot.tripped	Canary geactiveerd
cve.match.new	Nieuwe CVE-match (CVSS ≥ 7.0)
emergency.token.issued	Token uitgegeven (audit)