Set up Outgoing Webhooks
Connect Radiant Security outgoing webhooks to forward real-time alert status and connector status error updates to your systems.
Outgoing webhooks send real-time updates from Radiant Security to a destination URL you control. Radiant sends a payload when an alert reaches a status you select during setup, or when a connector reports an error. The rs_webhookTriggerType field in every payload identifies which trigger fired.
Originating IP addresses
Every webhook request that Radiant Security originates comes from one of our static IP addresses. You may need to allow list these IP addresses so that they can reach your system. Here are Radiant Security’s static IP addresses:
Radiant Security static IP addresses
100.21.80.201
52.11.97.167
35.164.70.154
Manage webhooks through Radiant Security
To access Radiant Security’s webhook management:
Log in to Radiant Security.
From the navigation menu, click Settings > Outgoing Webhooks.

To create a new Webhook, click + Add Webhook.

Add the Webhook Name and the Destination URL, then select the triggers you want this webhook to send. The trigger options include both alert statuses and connector status errors.
Click Next.

Under Custom Header Authentication, enter the Header Name and Header Value.

Click Test Connection to validate that the connection is successful.

Click Save Webhook.
If you experience any issue while setting up Outgoing Webhooks, please reach out to your Customer Success Manager for assistance.
Webhook payloads
Radiant Security sends a webhook payload for one of two trigger types, identified by the rs_webhookTriggerType field:
Alert status: Sent when an alert reaches a status you select during setup. The payload carries the full triage context: the summary, key findings, conclusion, and enriched artifacts.
Connector status changed to error: Sent when a connector reports an error. The payload carries the connector identity, the reported outcome, and the error detail.
Alert status payload
The webhook payload has the following schema:
Property
Description
Type
One of
rawAlert
The alert as ingested from vendor
object
—
rs_alertId
The unique ID of the Radiant alert
string
—
rs_alertVendor
The vendor that originated the alert
string
—
rs_alertNumber
The number code that uniquely identifies that alert in your Radiant environment, e.g. ALERT-1234
string
—
rs_tenantDisplayName
The name of your tenant within Radiant which originated the webhook
string
—
rs_alertUrl
The URL that points to that alert in Radiant’s UI
string
—
rs_conclusion
A summary of Radiant AI conclusion
string
—
rs_keyFindings
The key findings of the alert triage by Radiant AI
array of strings
—
rs_alertBrief
A brief of what happened
object
—
rs_alertBrief.summary
A summary of what happened
string
—
rs_alertBrief.intent
A summary of the attacker’s intent
string
—
rs_webhookTriggerTimestamp
The timestamp is in ISO 8601 format (e.g., 2025-05-14T21:37:56.840Z) and represents the time in UTC for when the webhook’s trigger event happened
string
—
rs_webhookTriggerType
The type of event that triggered this specific webhook
string
Recommended Benign, Recommended Malicious, Likely Benign, Marked Benign, Marked Malicious
rs_alertArtifacts
The entities involved, structured in categories by type of artifact (e.g. users, IPs, sensors, etc.)
array of objects
—
rs_alertArtifacts[].type
The type of that alert artifact
string
URL, File_Hash, User, IP, Sensor, Cloud_Resource, CVE, Unknown
rs_alertArtifacts[].value
The value of that alert artifact
string
—
rs_alertArtifacts[].enrichments
The enrichments that Radiant produced over that alert artifact
array of objects
—
rs_alertArtifacts[].enrichments.sentiment
The sentiment that Radiant AI has about that particular alert artifact enrichment
string
good, bad, informational, unknown
rs_alertArtifacts[].enrichments.description
Radiant AI’s description for that particular alert artifact enrichment
string
—
rs_alertArtifacts_v2.entityType
The type of alert artifact
string
human_identity, file, process, device, etc
rs_alertArtifacts_v2.displayName
The name of the artifact shown in Radiant
string
—
rs_alertArtifacts_v2.content
The enrichments Radiant produced for the alert artifact
array of objects
—
Connector status error payload
The connector status error payload has the following schema:
rs_connectorType
Unique code identifying the type of connector that reported the outcome
string
—
rs_connectorTypeName
Display name of the connector type
string
—
rs_connectorVendorName
Name of the connector's data vendor
string
—
rs_outcome
The status the connector reported
string
Error, CredentialsError
rs_errorMessage
Description of the error. Included only when an error detail is available
string
—
rs_tenantDisplayName
Display name of the affected tenant
string
—
rs_webhookTriggerType
The trigger type that produced this payload
string
Connector Status Error
rs_webhookTriggerTimestamp
The time the outcome was reported, in ISO 8601 date-time format
string
—
Payload examples
The examples below show a payload for each trigger type.
Marked Benign payload
This payload is generated when an alert is investigated and marked as Benign by the user.
Marked Malicious payload
This payload is generated when an alert is investigated and marked as Malicious by the user.
Connector status error payload
This payload is generated when a connector reports an error status.
Last updated
Was this helpful?