Set up Outgoing Webhooks

Connect Radiant Security outgoing webhooks to forward real-time alert status and connector status error updates to your systems.

Outgoing webhooks send real-time updates from Radiant Security to a destination URL you control. Radiant sends a payload when an alert reaches a status you select during setup, or when a connector reports an error. The rs_webhookTriggerType field in every payload identifies which trigger fired.

Originating IP addresses

Every webhook request that Radiant Security originates comes from one of our static IP addresses. You may need to allow list these IP addresses so that they can reach your system. Here are Radiant Security’s static IP addresses:

Radiant Security static IP addresses
100.21.80.201
52.11.97.167
35.164.70.154

Manage webhooks through Radiant Security

To access Radiant Security’s webhook management:

1. Log in to Radiant Security.
2. From the navigation menu, click Settings > Outgoing Webhooks.

1. To create a new Webhook, click + Add Webhook.

1. Add the Webhook Name and the Destination URL, then select the triggers you want this webhook to send. The trigger options include both alert statuses and connector status errors.
2. Click Next.

1. Under Custom Header Authentication, enter the Header Name and Header Value.

1. Click Test Connection to validate that the connection is successful.

1. Click Save Webhook.

If you experience any issue while setting up Outgoing Webhooks, please reach out to your Customer Success Manager for assistance.

Webhook payloads

Radiant Security sends a webhook payload for one of two trigger types, identified by the rs_webhookTriggerType field:

• Alert status: Sent when an alert reaches a status you select during setup. The payload carries the full triage context: the summary, key findings, conclusion, and enriched artifacts.
• Connector status changed to error: Sent when a connector reports an error. The payload carries the connector identity, the reported outcome, and the error detail.

Alert status payload

The webhook payload has the following schema:

Property	Description	Type	One of
rawAlert	The alert as ingested from vendor	object	—
rs_alertId	The unique ID of the Radiant alert	string	—
rs_alertVendor	The vendor that originated the alert	string	—
rs_alertNumber	The number code that uniquely identifies that alert in your Radiant environment, e.g. ALERT-1234	string	—
rs_tenantDisplayName	The name of your tenant within Radiant which originated the webhook	string	—
rs_alertUrl	The URL that points to that alert in Radiant’s UI	string	—
rs_conclusion	A summary of Radiant AI conclusion	string	—
rs_keyFindings	The key findings of the alert triage by Radiant AI	array of strings	—
rs_alertBrief	A brief of what happened	object	—
rs_alertBrief.summary	A summary of what happened	string	—
rs_alertBrief.intent	A summary of the attacker’s intent	string	—
rs_webhookTriggerTimestamp	The timestamp is in ISO 8601 format (e.g., 2025-05-14T21:37:56.840Z) and represents the time in UTC for when the webhook’s trigger event happened	string	—
rs_webhookTriggerType	The type of event that triggered this specific webhook	string	Recommended Benign, Recommended Malicious, Likely Benign, Marked Benign, Marked Malicious
rs_alertArtifacts	The entities involved, structured in categories by type of artifact (e.g. users, IPs, sensors, etc.)	array of objects	—
rs_alertArtifacts[].type	The type of that alert artifact	string	URL, File_Hash, User, IP, Sensor, Cloud_Resource, CVE, Unknown
rs_alertArtifacts[].value	The value of that alert artifact	string	—
rs_alertArtifacts[].enrichments	The enrichments that Radiant produced over that alert artifact	array of objects	—
rs_alertArtifacts[].enrichments.sentiment	The sentiment that Radiant AI has about that particular alert artifact enrichment	string	good, bad, informational, unknown
rs_alertArtifacts[].enrichments.description	Radiant AI’s description for that particular alert artifact enrichment	string	—
rs_alertArtifacts_v2.entityType	The type of alert artifact	string	human_identity, file, process, device, etc
rs_alertArtifacts_v2.displayName	The name of the artifact shown in Radiant	string	—
rs_alertArtifacts_v2.content	The enrichments Radiant produced for the alert artifact	array of objects	—

Connector status error payload

The connector status error payload has the following schema:

Property	Description	Type	One of
rs_connectorType	Unique code identifying the type of connector that reported the outcome	string	—
rs_connectorTypeName	Display name of the connector type	string	—
rs_connectorVendorName	Name of the connector's data vendor	string	—
rs_outcome	The status the connector reported	string	Error, CredentialsError
rs_errorMessage	Description of the error. Included only when an error detail is available	string	—
rs_tenantDisplayName	Display name of the affected tenant	string	—
rs_webhookTriggerType	The trigger type that produced this payload	string	Connector Status Error
rs_webhookTriggerTimestamp	The time the outcome was reported, in ISO 8601 date-time format	string	—

Payload examples

The examples below show a payload for each trigger type.

Marked Benign payload

This payload is generated when an alert is investigated and marked as Benign by the user.

{
  "rawAlert": {
    "id": "09f3XXXX-XXXX-XXXX-XXXX-XXXXXXXX3e01",
    "createdDateTime": "2025-12-27T04:06:58Z",
    "userDisplayName": "John Doe",
    "userPrincipalName": "[e-mail]",
    "userId": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234",
    "appId": "00000002-0000-0ff1-ce00-000000000000",
    "appDisplayName": "Office 365 Exchange Online",
    "ipAddress": "192.168.0.1",
    "clientAppUsed": "Browser",
    "correlationId": "25dcXXXX-XXXX-XXXX-XXXX-XXXXXXXXa456",
    "conditionalAccessStatus": "success",
    "isInteractive": true,
    "riskDetail": "none",
    "riskLevelAggregated": "low",
    "riskLevelDuringSignIn": "medium",
    "riskState": "atRisk",
    "riskEventTypes": [
      "unfamiliarFeatures"
    ],
    "riskEventTypes_v2": [
      "unfamiliarFeatures"
    ],
    "resourceDisplayName": "Office 365 Exchange Online",
    "resourceId": "0000XXXX-XXXX-XXXX-XXXX-XXXXXXXX0000",
    "status": {
      "errorCode": 0,
      "failureReason": "Other.",
      "additionalDetails": null
    },
    "deviceDetail": {
      "deviceId": "",
      "displayName": "",
      "operatingSystem": "Linux",
      "browser": "Chrome 115.0.0",
      "isCompliant": false,
      "isManaged": false,
      "trustType": ""
    },
    "location": {
      "city": "Surabaya",
      "state": "Jawa Timur",
      "countryOrRegion": "ID",
      "geoCoordinates": {
        "altitude": null,
        "latitude": -7.331,
        "longitude": 112.7688
      }
    },
    "appliedConditionalAccessPolicies": [
      {
        "id": "7701XXXX-XXXX-XXXX-XXXX-XXXXXXXX677b",
        "displayName": "Require MFA for Kyle",
        "enforcedGrantControls": [
          "Mfa"
        ],
        "enforcedSessionControls": [],
        "result": "notApplied"
      },
      {
        "id": "eeadXXXX-XXXX-XXXX-XXXX-XXXXXXXXa653",
        "displayName": "radiantsecurity_blocked_ips",
        "enforcedGrantControls": [
          "Block"
        ],
        "enforcedSessionControls": [],
        "result": "notApplied"
      },
      {
        "id": "33adXXXX-XXXX-XXXX-XXXX-XXXXXXXXf18a",
        "displayName": "Microsoft-managed: Multifactor authentication for admins accessing Microsoft Admin Portals",
        "enforcedGrantControls": [
          "Mfa"
        ],
        "enforcedSessionControls": [],
        "result": "notApplied"
      },
      {
        "id": "3f6eXXXX-XXXX-XXXX-XXXX-XXXXXXXX106e",
        "displayName": "Microsoft-managed: Multifactor authentication and reauthentication for risky sign-ins",
        "enforcedGrantControls": [
          "Mfa"
        ],
        "enforcedSessionControls": [
          "SignInFrequency"
        ],
        "result": "notApplied"
      },
      {
        "id": "bf19XXXX-XXXX-XXXX-XXXX-XXXXXXXXc83e",
        "displayName": "Shahar turn risky sign-ins into defender alerts",
        "enforcedGrantControls": [],
        "enforcedSessionControls": [
          "SignInFrequency"
        ],
        "result": "reportOnlyNotApplied"
      },
      {
        "id": "9fbeXXXX-XXXX-XXXX-XXXX-XXXXXXXX8fa7",
        "displayName": "n8n-shahar - no refrsh needed",
        "enforcedGrantControls": [],
        "enforcedSessionControls": [
          "SignInFrequency"
        ],
        "result": "reportOnlyNotApplied"
      }
    ]
  },
  "rs_alertId": "9379f474XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXf2667b7a",
  "rs_alertVendor": "Microsoft Office 365",
  "rs_alertNumber": "ALERT-65912",
  "rs_webhookTriggerTimestamp": "2026-01-16T19:24:14.001Z",
  "rs_alertUrl": "https://app.radiantsecurity.ai/alerts/tenant-uuid/alert-uuid/details",
  "rs_tenantDisplayName": "Acme Corp",
  "rs_webhookTriggerType": "Marked Benign",
  "rs_alertBrief": {
    "summary": "A sign-in attempt was detected for user 'John Doe' ([e-mail]) from an unfamiliar location in Surabaya, Jawa Timur, Indonesia, using a browser on a Linux device. The sign-in was marked as 'at risk' due to unfamiliar features, and the risk level during sign-in was medium. Conditional access policies requiring MFA were not applied.",
    "intent": "Access user account in Office 365 Exchange Online using compromised credentials."
  },
  "rs_conclusion": "The investigation reveals clear indicators of malicious activity: the user account was confirmed compromised twice with no remediation, exhibited 1,329 medium-risk sign-ins in 30 days, and the sign-in originated from a public proxy service. Despite some normal device usage patterns, the overwhelming evidence of account compromise, persistent risk state, and lack of adequate security measures strongly indicate ongoing malicious activity requiring immediate escalation and remediation.",
  "rs_keyFindings": [
    "User account confirmed compromised twice in 30 days with no remediation actions",
    "1,329 medium-risk sign-ins detected in the last 30 days indicating persistent suspicious activity",
    "Sign-in originated from public proxy IP service commonly used in malicious activities",
    "Device and browser usage (Linux/Chrome) consistent with user's normal behavior patterns",
    "Risk state remains 'confirmedCompromised' despite some risk remediation indicators",
    "No evidence of password reset or adequate risk remediation measures"
  ],
  "rs_alertArtifacts": [
    {
      "type": "User",
      "value": "[e-mail]",
      "enrichments": [
        {
          "sentiment": "informational",
          "description": "User \"[e-mail]\" was matched to \"John Doe\" using identity and access management (IAM) data."
        }
      ]
    },
    {
      "type": "User",
      "value": "John Doe",
      "enrichments": [
        {
          "sentiment": "informational",
          "description": "User \"John Doe\" was matched to multiple users using identity and access management (IAM) data."
        }
      ]
    },
    {
      "type": "User",
      "value": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234",
      "enrichments": [
        {
          "sentiment": "unknown",
          "description": "User was NOT found in the identity and access management (IAM) data. It may be a local user or IAM data was not available for this user."
        }
      ]
    },
    {
      "type": "IP",
      "value": "192.168.0.1",
      "enrichments": [
        {
          "sentiment": "unknown",
          "description": "IP address was NOT found on your organization's allow or block lists."
        },
        {
          "sentiment": "unknown",
          "description": "IP address was NOT identified by our threat intelligence services."
        },
        {
          "sentiment": "informational",
          "description": "IP address was associated with a known public proxy service."
        },
        {
          "sentiment": "informational",
          "description": "IP address was located in Bali, Indonesia, Asia."
        }
      ]
    }
  ],
  "rs_alertArtifacts_v2": [
    {
      "entityType": "human_identity",
      "displayName": "John Doe",
      "content": {
        "entity_type": "HUMAN_IDENTITY",
        "triage_entity_id": "john_doe",
        "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e376789",
        "data": {
          "user_principal_name": "[e-mail]",
          "user_name": "john.doe",
          "user_id": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234",
          "identity_type": "domain_user",
          "identity_source": "Microsoft Entra ID",
          "domain_name": "blastradiuslabs",
          "display_name": "John Doe"
        },
        "relationships": [],
        "citations": [
          {
            "field_name": "user_principal_name",
            "source": {
              "type": "alert_path",
              "path": "user_principal"
            }
          },
          {
            "field_name": "user_name",
            "source": {
              "type": "enrichment_reference",
              "ref": {
                "timestamp": "2026-03-17T23:02:35.512155+00:00",
                "supporting_data_source": {
                  "manifest": "radiant-security",
                  "source": "radiant-security_radiant-security_iam",
                  "source_name": "Microsoft AD Manual Upload"
                },
                "request": {
                  "request_type": "http-api",
                  "httpRequest": {
                    "path": "/context/iam-users/identity",
                    "method": "get",
                    "parameters": {
                      "identity": "[e-mail]"
                    }
                  },
                  "httpApiManifestRef": {
                    "sourceID": "radiant-security_radiant-security_iam",
                    "sourceVersion": "1234c6eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e3272d6789"
                  },
                  "vendorMetadata": {
                    "vendor_name": "radiant-security"
                  }
                },
                "response": {
                  "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                },
                "truncated_response": {
                  "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                }
              }
            }
          },
          {
            "field_name": "display_name",
            "source": {
              "type": "enrichment_reference",
              "ref": {
                "timestamp": "2026-03-17T23:02:35.512155+00:00",
                "supporting_data_source": {
                  "manifest": "radiant-security",
                  "source": "radiant-security_radiant-security_iam",
                  "source_name": "Microsoft AD Manual Upload"
                },
                "request": {
                  "request_type": "http-api",
                  "httpRequest": {
                    "path": "/context/iam-users/identity",
                    "method": "get",
                    "parameters": {
                      "identity": "[e-mail]"
                    }
                  },
                  "httpApiManifestRef": {
                    "sourceID": "radiant-security_radiant-security_iam",
                    "sourceVersion": "1234c6eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e3272d6789"
                  },
                  "vendorMetadata": {
                    "vendor_name": "radiant-security"
                  }
                },
                "response": {
                  "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                },
                "truncated_response": {
                  "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                }
              }
            }
          },
          {
            "field_name": "user_id",
            "source": {
              "type": "enrichment_reference",
              "ref": {
                "timestamp": "2026-03-17T23:02:35.512155+00:00",
                "supporting_data_source": {
                  "manifest": "radiant-security",
                  "source": "radiant-security_radiant-security_iam",
                  "source_name": "Microsoft AD Manual Upload"
                },
                "request": {
                  "request_type": "http-api",
                  "httpRequest": {
                    "path": "/context/iam-users/identity",
                    "method": "get",
                    "parameters": {
                      "identity": "[e-mail]"
                    }
                  },
                  "httpApiManifestRef": {
                    "sourceID": "radiant-security_radiant-security_iam",
                    "sourceVersion": "123456eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e327267890"
                  },
                  "vendorMetadata": {
                    "vendor_name": "radiant-security"
                  }
                },
                "response": {
                  "attachment_id": "6789028e-a241-4df4-b00f-373d74201234",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                },
                "truncated_response": {
                  "attachment_id": "6789028e-a241-4df4-b00f-373d74201234",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                }
              }
            }
          },
          {
            "field_name": "domain_name",
            "source": {
              "type": "enrichment_reference",
              "ref": {
                "timestamp": "2026-03-17T23:02:35.512155+00:00",
                "supporting_data_source": {
                  "manifest": "radiant-security",
                  "source": "radiant-security_radiant-security_iam",
                  "source_name": "Microsoft AD Manual Upload"
                },
                "request": {
                  "request_type": "http-api",
                  "httpRequest": {
                    "path": "/context/iam-users/identity",
                    "method": "get",
                    "parameters": {
                      "identity": "[e-mail]"
                    }
                  },
                  "httpApiManifestRef": {
                    "sourceID": "radiant-security_radiant-security_iam",
                    "sourceVersion": "123456eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e327267890"
                  },
                  "vendorMetadata": {
                    "vendor_name": "radiant-security"
                  }
                },
                "response": {
                  "attachment_id": "6789028e-a241-4df4-b00f-373d74201234",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                },
                "truncated_response": {
                  "attachment_id": "6789028e-a241-4df4-b00f-373d74201234",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                }
              }
            }
          }
        ],
        "holistic_enrichments": []
      }
    },
    {
      "entityType": "file",
      "displayName": "chrome.exe",
      "content": {
        "entity_type": "FILE",
        "triage_entity_id": "chrome_exe",
        "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e376789",
        "data": {
          "file_name": "chrome.exe",
          "file_hash": "1234XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
          "hash_sha256": "1234XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
          "hash_md5": "1234XXXXXXXXXXXXXXXXXXXXXXXXXX",
          "file_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
          "file_extension": "exe",
          "object_type": "file"
        },
        "relationships": [],
        "citations": [
          {
            "field_name": "file_name",
            "source": {
              "type": "alert_path",
              "path": "filename"
            }
          },
          {
            "field_name": "file_hash",
            "source": {
              "type": "alert_path",
              "path": "sha256"
            }
          },
          {
            "field_name": "hash_sha256",
            "source": {
              "type": "alert_path",
              "path": "sha256"
            }
          },
          {
            "field_name": "hash_md5",
            "source": {
              "type": "alert_path",
              "path": "md5"
            }
          },
          {
            "field_name": "file_path",
            "source": {
              "type": "alert_path",
              "path": "filepath"
            }
          }
        ],
        "holistic_enrichments": [
          {
            "result": {
              "text": "Not Found",
              "verdict": "good"
            },
            "timestamp": "2026-03-17T23:02:36.375059+00:00",
            "supporting_data_source": {
              "manifest": "malware-bazaar",
              "source": "abuse-ch_malware-bazaar_malware-bazaar",
              "source_name": "Abuse.ch Malware Bazaar"
            },
            "request": {
              "request_type": "http-api",
              "httpRequest": {
                "server": "https://mb-api.abuse.ch",
                "path": "/api/v1/",
                "method": "post",
                "parameters": {},
                "headers": {
                  "Content_Type": "application/x-www-form-urlencoded"
                },
                "body": {
                  "query": "get_info",
                  "hash": "12345689366e01bd6ce6471ff27c3782e2e16377a848426cf0b2e6ba67890"
                }
              },
              "httpApiManifestRef": {
                "sourceID": "abuse-ch_malware-bazaar_malware-bazaar",
                "sourceVersion": "123456da45ec96ec8a8b4df472ea6de58392f9fbb777f455b6d2d78980ab",
                "httpApiName": "malware-bazaar"
              },
              "vendorMetadata": {
                "vendor_name": "abuse-ch"
              }
            },
            "response": {
              "attachment_id": "1234e54b-4813-4404-a102-a7ab1b686789",
              "metadata": {
                "filename": "response.json"
              },
              "format": "json"
            },
            "truncated_response": {
              "attachment_id": "1234554b-4813-4404-a102-a7ab1b667890",
              "metadata": {
                "filename": "response.json"
              },
              "format": "json"
            }
          }
        ]
      }
    }
  ]
}

Marked Malicious payload

This payload is generated when an alert is investigated and marked as Malicious by the user.

{
  "rawAlert": {
    "id": "ae2eXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXf298",
    "requestId": "f1cbXXXX-XXXX-XXXX-XXXX-XXXXXXXX2b01",
    "correlationId": "25dcXXXX-XXXX-XXXX-XXXX-XXXXXXXXa456",
    "riskEventType": "unlikelyTravel",
    "riskState": "atRisk",
    "riskLevel": "medium",
    "riskDetail": "none",
    "source": "IdentityProtection",
    "detectionTimingType": "offline",
    "activity": "signin",
    "tokenIssuerType": "AzureAD",
    "ipAddress": "192.168.0.1",
    "activityDateTime": "2025-12-27T04:06:55.595379Z",
    "detectedDateTime": "2025-12-27T09:39:31.154748Z",
    "lastUpdatedDateTime": "2025-12-27T10:29:56.7676983Z",
    "userId": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234",
    "userDisplayName": "John Doe",
    "userPrincipalName": "[e-mail]",
    "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\"},{\"Key\":\"relatedEventTimeInUtc\",\"Value\":\"2025-12-27T02:18:57.652875Z\"},{\"Key\":\"relatedUserAgent\",\"Value\":\"\"},{\"Key\":\"deviceInformation\",\"Value\":\"\"},{\"Key\":\"relatedLocation\",\"Value\":{\"clientIP\":\"::1\",\"latitude\":null,\"longitude\":null,\"asn\":null,\"countryCode\":\"CH\",\"countryName\":null,\"state\":null,\"city\":null}},{\"Key\":\"requestId\",\"Value\":\"f1cbXXXX-XXXX-XXXX-XXXX-XXXXXXXX2b01\"},{\"Key\":\"correlationId\",\"Value\":\"25dcXXXX-XXXX-XXXX-XXXX-XXXXXXXXa456\"},{\"Key\":\"mitreTechniques\",\"Value\":\"T1078\"}]",
    "location": {
      "city": "Surabaya",
      "state": "Jawa Timur",
      "countryOrRegion": "ID",
      "geoCoordinates": {
        "latitude": -7.331,
        "longitude": 112.7688
      }
    }
  },
  "rs_alertId": "f474XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXf266",
  "rs_alertVendor": "Microsoft Office 365",
  "rs_alertNumber": "ALERT-65919",
  "rs_webhookTriggerTimestamp": "2026-01-16T19:24:00.433Z",
  "rs_alertUrl": "https://app.radiantsecurity.ai/alerts/tenant-uuid/alert-uuid/details",
  "rs_tenantDisplayName": "Acme Corp",
  "rs_webhookTriggerType": "Marked Malicious",
  "rs_conclusion": "Despite the user's previous familiarity with the source IP, the sign-in was flagged as medium-risk and classified as 'atRisk' by identity protection systems, indicating potential account compromise. The critical security gap lies in the absence of MFA enforcement and lack of remediation actions (password reset) following the risk detection. This combination of risk indicators without proper security controls suggests malicious activity that requires immediate attention and remediation.",
  "rs_keyFindings": [
    "User has previously signed in from the same IP address (192.168.0.1) on two occasions, indicating established usage pattern",
    "Sign-in was marked as medium-risk and classified as 'atRisk' by Microsoft Entra ID Protection, suggesting potential identity compromise",
    "MFA was not enforced during the authentication attempt despite the medium-risk classification",
    "No password reset was implemented following the risk detection, leaving potential vulnerability unaddressed",
    "IP address originates from a datacenter in Indonesia but is not flagged by threat intelligence or organizational security lists"
  ],
  "rs_alertArtifacts": [
    {
      "type": "User",
      "value": "[e-mail]",
      "enrichments": [
        {
          "sentiment": "informational",
          "description": "User \"[e-mail]\" was matched to \"John Doe\" using identity and access management (IAM) data."
        }
      ]
    },
    {
      "type": "User",
      "value": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234",
      "enrichments": [
        {
          "sentiment": "unknown",
          "description": "User was NOT found in the identity and access management (IAM) data. It may be a local user or IAM data was not available for this user."
        }
      ]
    },
    {
      "type": "IP",
      "value": "192.168.0.1",
      "enrichments": [
        {
          "sentiment": "unknown",
          "description": "IP address was NOT found on your organization's allow or block lists."
        },
        {
          "sentiment": "unknown",
          "description": "IP address was NOT identified by our threat intelligence services."
        },
        {
          "sentiment": "informational",
          "description": "IP address was associated with a cloud provider, hosting service, or colocation facility rather than a traditional ISP serving residential or business users."
        },
        {
          "sentiment": "informational",
          "description": "IP address was located in Bali, Indonesia, Asia."
        }
      ]
    },
    {
      "type": "User",
      "value": "John Doe",
      "enrichments": [
        {
          "sentiment": "informational",
          "description": "User \"John Doe\" was matched to multiple users using identity and access management (IAM) data."
        }
      ]
    },
    {
      "type": "IP",
      "value": "::1",
      "enrichments": [
        {
          "sentiment": "unknown",
          "description": "IP address was NOT found on your organization's allow or block lists."
        },
        {
          "sentiment": "unknown",
          "description": "IP address was NOT identified by our threat intelligence services."
        },
        {
          "sentiment": "informational",
          "description": "IP address was associated with a cloud provider, hosting service, or colocation facility rather than a traditional ISP serving residential or business users."
        },
        {
          "sentiment": "informational",
          "description": "IP address was located in Switzerland, Europe."
        }
      ]
    }
  ],
  "rs_alertArtifacts_v2": [
    {
      "entityType": "process",
      "displayName": "mimikatz.exe",
      "content": {
        "entity_type": "PROCESS",
        "triage_entity_id": "mimikatz_exe",
        "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e37e789",
        "data": {
          "process_name": "mimikatz.exe",
          "process_id": "1239036034116",
          "parent_process_id": "1238984285212",
          "command_line": "\"C:\\Users\\marc\\Desktop\\mimikatz_trunk\\Win32\\mimikatz.exe\"",
          "user_context": "BRPIL\\marc",
          "process_start_time": "2026-02-26T15:49:59Z"
        },
        "relationships": [
          {
            "relationship_type": "suspicion",
            "source_entity_id": "mimikatz_exe",
            "source_entity_type": "PROCESS",
            "dest_entity_id": "credential_dumping",
            "dest_entity_type": "IOC"
          },
          {
            "relationship_type": "running_as",
            "source_entity_id": "mimikatz_exe",
            "source_entity_type": "PROCESS",
            "dest_entity_id": "marc",
            "dest_entity_type": "HUMAN_IDENTITY"
          },
          {
            "relationship_type": "image_file",
            "source_entity_id": "mimikatz_exe",
            "source_entity_type": "PROCESS",
            "dest_entity_id": "mimikatz_exe",
            "dest_entity_type": "FILE"
          },
          {
            "relationship_type": "mitigation",
            "source_entity_id": "mimikatz_exe",
            "source_entity_type": "PROCESS",
            "dest_entity_id": "detection_only",
            "dest_entity_type": "CONTAINMENT"
          }
        ],
        "citations": [
          {
            "field_name": "process_name",
            "source": {
              "type": "alert_path",
              "path": "filename"
            }
          },
          {
            "field_name": "process_id",
            "source": {
              "type": "alert_path",
              "path": "process_id"
            }
          },
          {
            "field_name": "process_id",
            "source": {
              "type": "alert_path",
              "path": "tree_root"
            }
          },
          {
            "field_name": "parent_process_id",
            "source": {
              "type": "alert_path",
              "path": "parent_details.process_id"
            }
          },
          {
            "field_name": "parent_process_id",
            "source": {
              "type": "alert_path",
              "path": "parent_process_id"
            }
          }
        ],
        "holistic_enrichments": []
      }
    },
    {
      "entityType": "device",
      "displayName": "BRPIL\\PIL-EP10-1",
      "content": {
        "entity_type": "DEVICE",
        "triage_entity_id": "PIL_EP10_1",
        "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e376789",
        "data": {
          "device_name": "BRPIL\\PIL-EP10-1",
          "device_id": "12349766d866410ab1194349a4bb6789",
          "os_name": "Windows 10",
          "os_version": "10.0",
          "device_type": "Workstation",
          "is_managed": true,
          "ip_addresses": [
            "10.200.1.101",
            "22.224.152.57"
          ]
        },
        "relationships": [
          {
            "relationship_type": "session",
            "source_entity_id": "PIL_EP10_1",
            "source_entity_type": "DEVICE",
            "dest_entity_id": "1",
            "dest_entity_type": "LOGON_SESSION"
          }
        ],
        "citations": [
          {
            "field_name": "device_id",
            "source": {
              "type": "alert_path",
              "path": "device.device_id"
            }
          },
          {
            "field_name": "os_name",
            "source": {
              "type": "alert_path",
              "path": "device.os_version"
            }
          },
          {
            "field_name": "device_type",
            "source": {
              "type": "alert_path",
              "path": "device.product_type_desc"
            }
          },
          {
            "field_name": "ip_addresses",
            "source": {
              "type": "alert_path",
              "path": "device.local_ip"
            }
          },
          {
            "field_name": "ip_addresses",
            "source": {
              "type": "alert_path",
              "path": "device.external_ip"
            }
          },
          {
            "field_name": "ip_addresses",
            "source": {
              "type": "enrichment_reference",
              "ref": {
                "timestamp": "2026-03-17T23:02:29.262066+00:00",
                "supporting_data_source": {
                  "manifest": "fdr",
                  "source": "crowdstrike_fdr_sensor-info",
                  "source_name": "CrowdStrike Falcon Sensor-info"
                },
                "request": {
                  "request_type": "ab-type7",
                  "qw_query": {
                    "query": "rs_connectorType:'crowdstrike_fdr' AND rs_subType:'fdrv2-aidmaster' AND (aid:'12349766d866410ab1194349a4bb6789' OR ComputerName:'12349766d866410ab1194349a4bb6789')",
                    "start_timestamp": 1745250599,
                    "end_timestamp": 1745855399,
                    "sort_by": "rs_timestamp"
                  },
                  "meta": {
                    "start_timestamp": "2025-04-21T15:49:59+00:00",
                    "end_timestamp": "2025-04-28T15:49:59+00:00",
                    "connector_source_name": "CrowdStrike Falcon Sensor-info"
                  }
                },
                "response": {
                  "attachment_id": "12349304-c052-4cfe-b28f-6ec85ffa6789",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                },
                "truncated_response": {
                  "attachment_id": "12349304-c052-4cfe-b28f-6ec85ffa6789",
                  "metadata": {
                    "filename": "response.json"
                  },
                  "format": "json"
                }
              }
            }
          }
        ],
        "holistic_enrichments": []
      }
    }
  ],
  "rs_alertBrief": {
    "summary": "An unlikely travel event was detected for user 'John Doe' ([e-mail]) with a sign-in attempt from IP '192.168.0.1' in Surabaya, Indonesia, while a related location was identified in Switzerland with IP '::1'. The activity was flagged as medium risk by Microsoft Entra ID Protection.",
    "intent": "Access user account using compromised credentials from an unusual location."
  }
}

Connector status error payload

This payload is generated when a connector reports an error status.

{
  "rs_connectorType": "sentinelone_alert_source",
  "rs_connectorTypeName": "SentinelOne Alerts & Sensor Info",
  "rs_connectorVendorName": "SentinelOne",
  "rs_outcome": "CredentialsError",
  "rs_errorMessage": "unauthorized error: Request failed with status code 401",
  "rs_tenantDisplayName": "Test Tenant",
  "rs_webhookTriggerType": "Connector Status Error",
  "rs_webhookTriggerTimestamp": "2026-06-19T13:32:08.246Z"
}