Watch a video about Security & UEBA Alerts including configuration

Webhook configuration in the ZIA Admin Portal allows you to deliver alerts for the configured events in the alert rule to third-party applications (e.g., ServiceNow, Splunk, etc.) for incident management. The feature comprises two parts:

1. Creating a webhook
2. Associating the webhook with the alert rules

To add a webhook:

1. Go to Alerts > Webhooks.
2. Click Add Webhook.

The Add Webhook window appears.

3. In the Add Webhook window:

• Name: Enter a name for the webhook.
• Status: Choose Disabled to disable the webhook. By default, the field is Enabled.
• URL: Enter the URL of the webhook provider
• Authentication Type: Choose either Basic or Token for authentication. The webhook provider determines the authentication type used. Refer to your provider for details.
  • For Basic, enter the Username and Password.
  • For Token, enter the Bearer Token. A bearer token is a unique alphanumeric string used for authentication. You can obtain the bearer token from your webhook provider.

4. Click Test Webhook to check the configuration.

If the test is successful, a message indicating success appears.

5. Click Save and activate the change.