IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Slack action Preconfigured connectors and action types »

› › ›

Webhook action

edit

Webhook action

edit

The Webhook action type uses axios to send a POST or PUT request to a web service.

Connector configuration

edit

Webhook connectors have the following configuration properties:

Name: The name of the connector. The name is used to identify a connector in the management UI connector listing, or in the connector list when configuring an action.
URL: The request URL. If you are using the xpack.actions.allowedHosts setting, make sure the hostname is added to the allowed hosts.
Method: HTTP request method, either post(default) or put.
Headers: A set of key-value pairs sent as headers with the request
User: An optional username. If set, HTTP basic authentication is used. Currently only basic authentication is supported.
Password: An optional password. If set, HTTP basic authentication is used. Currently only basic authentication is supported.

Preconfigured action type

edit

 my-webhook:
   name: preconfigured-webhook-action-type
   actionTypeId: .webhook
   config:
     url: https://test.host
     method: POST
     headers:
       testheader: testvalue
   secrets:
     user: testuser
     password: passwordkeystorevalue

config defines the action type specific to the configuration and contains the following properties:

`url`	A URL string that corresponds to URL.
`method`	A string that corresponds to Method.
`headers`	A record<string, string> that corresponds to Headers.

secrets defines sensitive information for the action type:

`user`	A string that corresponds to User.
`password`	A string that corresponds to Password. Should be stored in the Kibana keystore.

Action configuration

edit

Webhook actions have the following properties:

Body

A JSON payload sent to the request URL. For example:

{
  "short_description": "{{context.rule.name}}",
  "description": "{{context.rule.description}}",
  ...
}

Mustache template variables (the text enclosed in double braces, for example, context.rule.name) have their values escaped, so that the final JSON will be valid (escaping double quote characters). For more information on Mustache template variables, refer to Action type and action details.

« Slack action Preconfigured connectors and action types »