> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/export-logs/outgoing-webhooks/set-up-outgoing-webhooks.md). # Set up Outgoing Webhooks Outgoing webhooks send real-time updates from Radiant Security to a destination URL you control. Radiant sends a payload when an alert reaches a status you select during setup, or when a connector reports an error. The `rs_webhookTriggerType` field in every payload identifies which trigger fired. ### Originating IP addresses Every webhook request that Radiant Security originates comes from one of our static IP addresses. You may need to allow list these IP addresses so that they can reach your system. Here are Radiant Security’s static IP addresses: | **Radiant Security static IP addresses** | | ---------------------------------------- | | 100.21.80.201 | | 52.11.97.167 | | 35.164.70.154 | ### Manage webhooks through Radiant Security To access Radiant Security’s webhook management: 1. Log in to [Radiant Security](https://app.radiantsecurity.ai/). 2. From the navigation menu, click **Settings** > **Outgoing Webhooks.**
3. To create a new Webhook, click **+ Add Webhook**.
4. Add the **Webhook Name** and the **Destination URL**, then select the triggers you want this webhook to send. The trigger options include both alert statuses and connector status errors. 5. Click **Next**.
6. Under **Custom Header Authentication**, enter the **Header Name** and **Header Value**.
6. Click **Test Connection** to validate that the connection is successful.
7. Click **Save Webhook**. {% hint style="info" %} If you experience any issue while setting up Outgoing Webhooks, please reach out to your Customer Success Manager for assistance. {% endhint %} ### Webhook payloads Radiant Security sends a webhook payload for one of two trigger types, identified by the `rs_webhookTriggerType` field: * **Alert status:** Sent when an alert reaches a status you select during setup. The payload carries the full triage context: the summary, key findings, conclusion, and enriched artifacts. * **Connector status changed to error:** Sent when a connector reports an error. The payload carries the connector identity, the reported outcome, and the error detail. **Alert status payload** The webhook payload has the following schema: | **Property** | **Description** | **Type** | One of | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | --------------------------------------------------------------------------------------------------- | | rawAlert | The alert as ingested from vendor | `object` | — | | rs\_alertId | The unique ID of the Radiant alert | `string` | — | | rs\_alertVendor | The vendor that originated the alert | `string` | — | | rs\_alertNumber | The number code that uniquely identifies that alert in your Radiant environment, e.g. `ALERT-1234` | `string` | — | | rs\_tenantDisplayName | The name of your tenant within Radiant which originated the webhook | `string` | — | | rs\_alertUrl | The URL that points to that alert in Radiant’s UI | `string` | — | | rs\_conclusion | A summary of Radiant AI conclusion | `string` | — | | rs\_keyFindings | The key findings of the alert triage by Radiant AI | `array of strings` | — | | rs\_alertBrief | A brief of what happened | `object` | — | | rs\_alertBrief.summary | A summary of what happened | `string` | — | | rs\_alertBrief.intent | A summary of the attacker’s intent | `string` | — | | rs\_webhookTriggerTimestamp | The timestamp is in ISO 8601 format (e.g., 2025-05-14T21:37:56.840Z) and represents the time in UTC for when the webhook’s trigger event happened | `string` | — | | rs\_webhookTriggerType | The type of event that triggered this specific webhook | `string` | `Recommended Benign`, `Recommended Malicious`, `Likely Benign`, `Marked Benign`, `Marked Malicious` | | rs\_alertArtifacts | The entities involved, structured in categories by type of artifact (e.g. users, IPs, sensors, etc.) | `array of objects` | — | | rs\_alertArtifacts\[].type | The type of that alert artifact | `string` | `URL`, `File_Hash`, `User`, `IP`, `Sensor`, `Cloud_Resource`, `CVE`, `Unknown` | | rs\_alertArtifacts\[].value | The value of that alert artifact | `string` | — | | rs\_alertArtifacts\[].enrichments | The enrichments that Radiant produced over that alert artifact | `array of objects` | — | | rs\_alertArtifacts\[].enrichments.sentiment | The sentiment that Radiant AI has about that particular alert artifact enrichment | `string` | `good`, `bad`, `informational`, `unknown` | | rs\_alertArtifacts\[].enrichments.description | Radiant AI’s description for that particular alert artifact enrichment | `string` | — | | rs\_alertArtifacts\_v2.entityType | The type of alert artifact | `string` | `human_identity`, `file`, `process`, `device`, etc | | rs\_alertArtifacts\_v2.displayName | The name of the artifact shown in Radiant | `string` | — | | rs\_alertArtifacts\_v2.content | The enrichments Radiant produced for the alert artifact | `array of objects` | — | ### **Connector status error payload** The connector status error payload has the following schema: | Property | Description | Type | One of | | --------------------------- | ------------------------------------------------------------------------- | -------- | --------------------------- | | rs\_connectorType | Unique code identifying the type of connector that reported the outcome | `string` | — | | rs\_connectorTypeName | Display name of the connector type | `string` | — | | rs\_connectorVendorName | Name of the connector's data vendor | `string` | — | | rs\_outcome | The status the connector reported | `string` | `Error`, `CredentialsError` | | rs\_errorMessage | Description of the error. Included only when an error detail is available | `string` | — | | rs\_tenantDisplayName | Display name of the affected tenant | `string` | — | | rs\_webhookTriggerType | The trigger type that produced this payload | `string` | `Connector Status Error` | | rs\_webhookTriggerTimestamp | The time the outcome was reported, in ISO 8601 date-time format | `string` | — | ### **Payload examples** The examples below show a payload for each trigger type. #### **Marked Benign payload** This payload is generated when an alert is investigated and marked as Benign by the user. {% code overflow="wrap" %} ```json { "rawAlert": { "id": "09f3XXXX-XXXX-XXXX-XXXX-XXXXXXXX3e01", "createdDateTime": "2025-12-27T04:06:58Z", "userDisplayName": "John Doe", "userPrincipalName": "john.doe@blastradiuslabs.com", "userId": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234", "appId": "00000002-0000-0ff1-ce00-000000000000", "appDisplayName": "Office 365 Exchange Online", "ipAddress": "192.168.0.1", "clientAppUsed": "Browser", "correlationId": "25dcXXXX-XXXX-XXXX-XXXX-XXXXXXXXa456", "conditionalAccessStatus": "success", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "low", "riskLevelDuringSignIn": "medium", "riskState": "atRisk", "riskEventTypes": [ "unfamiliarFeatures" ], "riskEventTypes_v2": [ "unfamiliarFeatures" ], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "0000XXXX-XXXX-XXXX-XXXX-XXXXXXXX0000", "status": { "errorCode": 0, "failureReason": "Other.", "additionalDetails": null }, "deviceDetail": { "deviceId": "", "displayName": "", "operatingSystem": "Linux", "browser": "Chrome 115.0.0", "isCompliant": false, "isManaged": false, "trustType": "" }, "location": { "city": "Surabaya", "state": "Jawa Timur", "countryOrRegion": "ID", "geoCoordinates": { "altitude": null, "latitude": -7.331, "longitude": 112.7688 } }, "appliedConditionalAccessPolicies": [ { "id": "7701XXXX-XXXX-XXXX-XXXX-XXXXXXXX677b", "displayName": "Require MFA for Kyle", "enforcedGrantControls": [ "Mfa" ], "enforcedSessionControls": [], "result": "notApplied" }, { "id": "eeadXXXX-XXXX-XXXX-XXXX-XXXXXXXXa653", "displayName": "radiantsecurity_blocked_ips", "enforcedGrantControls": [ "Block" ], "enforcedSessionControls": [], "result": "notApplied" }, { "id": "33adXXXX-XXXX-XXXX-XXXX-XXXXXXXXf18a", "displayName": "Microsoft-managed: Multifactor authentication for admins accessing Microsoft Admin Portals", "enforcedGrantControls": [ "Mfa" ], "enforcedSessionControls": [], "result": "notApplied" }, { "id": "3f6eXXXX-XXXX-XXXX-XXXX-XXXXXXXX106e", "displayName": "Microsoft-managed: Multifactor authentication and reauthentication for risky sign-ins", "enforcedGrantControls": [ "Mfa" ], "enforcedSessionControls": [ "SignInFrequency" ], "result": "notApplied" }, { "id": "bf19XXXX-XXXX-XXXX-XXXX-XXXXXXXXc83e", "displayName": "Shahar turn risky sign-ins into defender alerts", "enforcedGrantControls": [], "enforcedSessionControls": [ "SignInFrequency" ], "result": "reportOnlyNotApplied" }, { "id": "9fbeXXXX-XXXX-XXXX-XXXX-XXXXXXXX8fa7", "displayName": "n8n-shahar - no refrsh needed", "enforcedGrantControls": [], "enforcedSessionControls": [ "SignInFrequency" ], "result": "reportOnlyNotApplied" } ] }, "rs_alertId": "9379f474XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXf2667b7a", "rs_alertVendor": "Microsoft Office 365", "rs_alertNumber": "ALERT-65912", "rs_webhookTriggerTimestamp": "2026-01-16T19:24:14.001Z", "rs_alertUrl": "https://app.radiantsecurity.ai/alerts/tenant-uuid/alert-uuid/details", "rs_tenantDisplayName": "Acme Corp", "rs_webhookTriggerType": "Marked Benign", "rs_alertBrief": { "summary": "A sign-in attempt was detected for user 'John Doe' (john.doe@blastradiuslabs.com) from an unfamiliar location in Surabaya, Jawa Timur, Indonesia, using a browser on a Linux device. The sign-in was marked as 'at risk' due to unfamiliar features, and the risk level during sign-in was medium. Conditional access policies requiring MFA were not applied.", "intent": "Access user account in Office 365 Exchange Online using compromised credentials." }, "rs_conclusion": "The investigation reveals clear indicators of malicious activity: the user account was confirmed compromised twice with no remediation, exhibited 1,329 medium-risk sign-ins in 30 days, and the sign-in originated from a public proxy service. Despite some normal device usage patterns, the overwhelming evidence of account compromise, persistent risk state, and lack of adequate security measures strongly indicate ongoing malicious activity requiring immediate escalation and remediation.", "rs_keyFindings": [ "User account confirmed compromised twice in 30 days with no remediation actions", "1,329 medium-risk sign-ins detected in the last 30 days indicating persistent suspicious activity", "Sign-in originated from public proxy IP service commonly used in malicious activities", "Device and browser usage (Linux/Chrome) consistent with user's normal behavior patterns", "Risk state remains 'confirmedCompromised' despite some risk remediation indicators", "No evidence of password reset or adequate risk remediation measures" ], "rs_alertArtifacts": [ { "type": "User", "value": "john.doe@blastradiuslabs.com", "enrichments": [ { "sentiment": "informational", "description": "User \"john.doe@blastradiuslabs.com\" was matched to \"John Doe\" using identity and access management (IAM) data." } ] }, { "type": "User", "value": "John Doe", "enrichments": [ { "sentiment": "informational", "description": "User \"John Doe\" was matched to multiple users using identity and access management (IAM) data." } ] }, { "type": "User", "value": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234", "enrichments": [ { "sentiment": "unknown", "description": "User was NOT found in the identity and access management (IAM) data. It may be a local user or IAM data was not available for this user." } ] }, { "type": "IP", "value": "192.168.0.1", "enrichments": [ { "sentiment": "unknown", "description": "IP address was NOT found on your organization's allow or block lists." }, { "sentiment": "unknown", "description": "IP address was NOT identified by our threat intelligence services." }, { "sentiment": "informational", "description": "IP address was associated with a known public proxy service." }, { "sentiment": "informational", "description": "IP address was located in Bali, Indonesia, Asia." } ] } ], "rs_alertArtifacts_v2": [ { "entityType": "human_identity", "displayName": "John Doe", "content": { "entity_type": "HUMAN_IDENTITY", "triage_entity_id": "john_doe", "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e376789", "data": { "user_principal_name": "john.doe@blastradiuslabs.com", "user_name": "john.doe", "user_id": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234", "identity_type": "domain_user", "identity_source": "Microsoft Entra ID", "domain_name": "blastradiuslabs", "display_name": "John Doe" }, "relationships": [], "citations": [ { "field_name": "user_principal_name", "source": { "type": "alert_path", "path": "user_principal" } }, { "field_name": "user_name", "source": { "type": "enrichment_reference", "ref": { "timestamp": "2026-03-17T23:02:35.512155+00:00", "supporting_data_source": { "manifest": "radiant-security", "source": "radiant-security_radiant-security_iam", "source_name": "Microsoft AD Manual Upload" }, "request": { "request_type": "http-api", "httpRequest": { "path": "/context/iam-users/identity", "method": "get", "parameters": { "identity": "john.doe@blastradiuslabs.com" } }, "httpApiManifestRef": { "sourceID": "radiant-security_radiant-security_iam", "sourceVersion": "1234c6eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e3272d6789" }, "vendorMetadata": { "vendor_name": "radiant-security" } }, "response": { "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789", "metadata": { "filename": "response.json" }, "format": "json" }, "truncated_response": { "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789", "metadata": { "filename": "response.json" }, "format": "json" } } } }, { "field_name": "display_name", "source": { "type": "enrichment_reference", "ref": { "timestamp": "2026-03-17T23:02:35.512155+00:00", "supporting_data_source": { "manifest": "radiant-security", "source": "radiant-security_radiant-security_iam", "source_name": "Microsoft AD Manual Upload" }, "request": { "request_type": "http-api", "httpRequest": { "path": "/context/iam-users/identity", "method": "get", "parameters": { "identity": "john.doe@blastradiuslabs.com" } }, "httpApiManifestRef": { "sourceID": "radiant-security_radiant-security_iam", "sourceVersion": "1234c6eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e3272d6789" }, "vendorMetadata": { "vendor_name": "radiant-security" } }, "response": { "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789", "metadata": { "filename": "response.json" }, "format": "json" }, "truncated_response": { "attachment_id": "1234228e-a241-4df4-b00f-373d742a6789", "metadata": { "filename": "response.json" }, "format": "json" } } } }, { "field_name": "user_id", "source": { "type": "enrichment_reference", "ref": { "timestamp": "2026-03-17T23:02:35.512155+00:00", "supporting_data_source": { "manifest": "radiant-security", "source": "radiant-security_radiant-security_iam", "source_name": "Microsoft AD Manual Upload" }, "request": { "request_type": "http-api", "httpRequest": { "path": "/context/iam-users/identity", "method": "get", "parameters": { "identity": "john.doe@blastradiuslabs.com" } }, "httpApiManifestRef": { "sourceID": "radiant-security_radiant-security_iam", "sourceVersion": "123456eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e327267890" }, "vendorMetadata": { "vendor_name": "radiant-security" } }, "response": { "attachment_id": "6789028e-a241-4df4-b00f-373d74201234", "metadata": { "filename": "response.json" }, "format": "json" }, "truncated_response": { "attachment_id": "6789028e-a241-4df4-b00f-373d74201234", "metadata": { "filename": "response.json" }, "format": "json" } } } }, { "field_name": "domain_name", "source": { "type": "enrichment_reference", "ref": { "timestamp": "2026-03-17T23:02:35.512155+00:00", "supporting_data_source": { "manifest": "radiant-security", "source": "radiant-security_radiant-security_iam", "source_name": "Microsoft AD Manual Upload" }, "request": { "request_type": "http-api", "httpRequest": { "path": "/context/iam-users/identity", "method": "get", "parameters": { "identity": "john.doe@blastradiuslabs.com" } }, "httpApiManifestRef": { "sourceID": "radiant-security_radiant-security_iam", "sourceVersion": "123456eaef2c3f5eb81a52fc1c13ce4858474424272771e4135a05e327267890" }, "vendorMetadata": { "vendor_name": "radiant-security" } }, "response": { "attachment_id": "6789028e-a241-4df4-b00f-373d74201234", "metadata": { "filename": "response.json" }, "format": "json" }, "truncated_response": { "attachment_id": "6789028e-a241-4df4-b00f-373d74201234", "metadata": { "filename": "response.json" }, "format": "json" } } } } ], "holistic_enrichments": [] } }, { "entityType": "file", "displayName": "chrome.exe", "content": { "entity_type": "FILE", "triage_entity_id": "chrome_exe", "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e376789", "data": { "file_name": "chrome.exe", "file_hash": "1234XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "hash_sha256": "1234XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "hash_md5": "1234XXXXXXXXXXXXXXXXXXXXXXXXXX", "file_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "file_extension": "exe", "object_type": "file" }, "relationships": [], "citations": [ { "field_name": "file_name", "source": { "type": "alert_path", "path": "filename" } }, { "field_name": "file_hash", "source": { "type": "alert_path", "path": "sha256" } }, { "field_name": "hash_sha256", "source": { "type": "alert_path", "path": "sha256" } }, { "field_name": "hash_md5", "source": { "type": "alert_path", "path": "md5" } }, { "field_name": "file_path", "source": { "type": "alert_path", "path": "filepath" } } ], "holistic_enrichments": [ { "result": { "text": "Not Found", "verdict": "good" }, "timestamp": "2026-03-17T23:02:36.375059+00:00", "supporting_data_source": { "manifest": "malware-bazaar", "source": "abuse-ch_malware-bazaar_malware-bazaar", "source_name": "Abuse.ch Malware Bazaar" }, "request": { "request_type": "http-api", "httpRequest": { "server": "https://mb-api.abuse.ch", "path": "/api/v1/", "method": "post", "parameters": {}, "headers": { "Content_Type": "application/x-www-form-urlencoded" }, "body": { "query": "get_info", "hash": "12345689366e01bd6ce6471ff27c3782e2e16377a848426cf0b2e6ba67890" } }, "httpApiManifestRef": { "sourceID": "abuse-ch_malware-bazaar_malware-bazaar", "sourceVersion": "123456da45ec96ec8a8b4df472ea6de58392f9fbb777f455b6d2d78980ab", "httpApiName": "malware-bazaar" }, "vendorMetadata": { "vendor_name": "abuse-ch" } }, "response": { "attachment_id": "1234e54b-4813-4404-a102-a7ab1b686789", "metadata": { "filename": "response.json" }, "format": "json" }, "truncated_response": { "attachment_id": "1234554b-4813-4404-a102-a7ab1b667890", "metadata": { "filename": "response.json" }, "format": "json" } } ] } } ] } ``` {% endcode %} #### **Marked Malicious payload** This payload is generated when an alert is investigated and marked as Malicious by the user. ```json { "rawAlert": { "id": "ae2eXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXf298", "requestId": "f1cbXXXX-XXXX-XXXX-XXXX-XXXXXXXX2b01", "correlationId": "25dcXXXX-XXXX-XXXX-XXXX-XXXXXXXXa456", "riskEventType": "unlikelyTravel", "riskState": "atRisk", "riskLevel": "medium", "riskDetail": "none", "source": "IdentityProtection", "detectionTimingType": "offline", "activity": "signin", "tokenIssuerType": "AzureAD", "ipAddress": "192.168.0.1", "activityDateTime": "2025-12-27T04:06:55.595379Z", "detectedDateTime": "2025-12-27T09:39:31.154748Z", "lastUpdatedDateTime": "2025-12-27T10:29:56.7676983Z", "userId": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234", "userDisplayName": "John Doe", "userPrincipalName": "john.doe@blastradiuslabs.com", "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\"},{\"Key\":\"relatedEventTimeInUtc\",\"Value\":\"2025-12-27T02:18:57.652875Z\"},{\"Key\":\"relatedUserAgent\",\"Value\":\"\"},{\"Key\":\"deviceInformation\",\"Value\":\"\"},{\"Key\":\"relatedLocation\",\"Value\":{\"clientIP\":\"::1\",\"latitude\":null,\"longitude\":null,\"asn\":null,\"countryCode\":\"CH\",\"countryName\":null,\"state\":null,\"city\":null}},{\"Key\":\"requestId\",\"Value\":\"f1cbXXXX-XXXX-XXXX-XXXX-XXXXXXXX2b01\"},{\"Key\":\"correlationId\",\"Value\":\"25dcXXXX-XXXX-XXXX-XXXX-XXXXXXXXa456\"},{\"Key\":\"mitreTechniques\",\"Value\":\"T1078\"}]", "location": { "city": "Surabaya", "state": "Jawa Timur", "countryOrRegion": "ID", "geoCoordinates": { "latitude": -7.331, "longitude": 112.7688 } } }, "rs_alertId": "f474XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXf266", "rs_alertVendor": "Microsoft Office 365", "rs_alertNumber": "ALERT-65919", "rs_webhookTriggerTimestamp": "2026-01-16T19:24:00.433Z", "rs_alertUrl": "https://app.radiantsecurity.ai/alerts/tenant-uuid/alert-uuid/details", "rs_tenantDisplayName": "Acme Corp", "rs_webhookTriggerType": "Marked Malicious", "rs_conclusion": "Despite the user's previous familiarity with the source IP, the sign-in was flagged as medium-risk and classified as 'atRisk' by identity protection systems, indicating potential account compromise. The critical security gap lies in the absence of MFA enforcement and lack of remediation actions (password reset) following the risk detection. This combination of risk indicators without proper security controls suggests malicious activity that requires immediate attention and remediation.", "rs_keyFindings": [ "User has previously signed in from the same IP address (192.168.0.1) on two occasions, indicating established usage pattern", "Sign-in was marked as medium-risk and classified as 'atRisk' by Microsoft Entra ID Protection, suggesting potential identity compromise", "MFA was not enforced during the authentication attempt despite the medium-risk classification", "No password reset was implemented following the risk detection, leaving potential vulnerability unaddressed", "IP address originates from a datacenter in Indonesia but is not flagged by threat intelligence or organizational security lists" ], "rs_alertArtifacts": [ { "type": "User", "value": "john.doe@blastradiuslabs.com", "enrichments": [ { "sentiment": "informational", "description": "User \"john.doe@blastradiuslabs.com\" was matched to \"John Doe\" using identity and access management (IAM) data." } ] }, { "type": "User", "value": "4e9bXXXX-XXXX-XXXX-XXXX-XXXXXXXXa234", "enrichments": [ { "sentiment": "unknown", "description": "User was NOT found in the identity and access management (IAM) data. It may be a local user or IAM data was not available for this user." } ] }, { "type": "IP", "value": "192.168.0.1", "enrichments": [ { "sentiment": "unknown", "description": "IP address was NOT found on your organization's allow or block lists." }, { "sentiment": "unknown", "description": "IP address was NOT identified by our threat intelligence services." }, { "sentiment": "informational", "description": "IP address was associated with a cloud provider, hosting service, or colocation facility rather than a traditional ISP serving residential or business users." }, { "sentiment": "informational", "description": "IP address was located in Bali, Indonesia, Asia." } ] }, { "type": "User", "value": "John Doe", "enrichments": [ { "sentiment": "informational", "description": "User \"John Doe\" was matched to multiple users using identity and access management (IAM) data." } ] }, { "type": "IP", "value": "::1", "enrichments": [ { "sentiment": "unknown", "description": "IP address was NOT found on your organization's allow or block lists." }, { "sentiment": "unknown", "description": "IP address was NOT identified by our threat intelligence services." }, { "sentiment": "informational", "description": "IP address was associated with a cloud provider, hosting service, or colocation facility rather than a traditional ISP serving residential or business users." }, { "sentiment": "informational", "description": "IP address was located in Switzerland, Europe." } ] } ], "rs_alertArtifacts_v2": [ { "entityType": "process", "displayName": "mimikatz.exe", "content": { "entity_type": "PROCESS", "triage_entity_id": "mimikatz_exe", "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e37e789", "data": { "process_name": "mimikatz.exe", "process_id": "1239036034116", "parent_process_id": "1238984285212", "command_line": "\"C:\\Users\\marc\\Desktop\\mimikatz_trunk\\Win32\\mimikatz.exe\"", "user_context": "BRPIL\\marc", "process_start_time": "2026-02-26T15:49:59Z" }, "relationships": [ { "relationship_type": "suspicion", "source_entity_id": "mimikatz_exe", "source_entity_type": "PROCESS", "dest_entity_id": "credential_dumping", "dest_entity_type": "IOC" }, { "relationship_type": "running_as", "source_entity_id": "mimikatz_exe", "source_entity_type": "PROCESS", "dest_entity_id": "marc", "dest_entity_type": "HUMAN_IDENTITY" }, { "relationship_type": "image_file", "source_entity_id": "mimikatz_exe", "source_entity_type": "PROCESS", "dest_entity_id": "mimikatz_exe", "dest_entity_type": "FILE" }, { "relationship_type": "mitigation", "source_entity_id": "mimikatz_exe", "source_entity_type": "PROCESS", "dest_entity_id": "detection_only", "dest_entity_type": "CONTAINMENT" } ], "citations": [ { "field_name": "process_name", "source": { "type": "alert_path", "path": "filename" } }, { "field_name": "process_id", "source": { "type": "alert_path", "path": "process_id" } }, { "field_name": "process_id", "source": { "type": "alert_path", "path": "tree_root" } }, { "field_name": "parent_process_id", "source": { "type": "alert_path", "path": "parent_details.process_id" } }, { "field_name": "parent_process_id", "source": { "type": "alert_path", "path": "parent_process_id" } } ], "holistic_enrichments": [] } }, { "entityType": "device", "displayName": "BRPIL\\PIL-EP10-1", "content": { "entity_type": "DEVICE", "triage_entity_id": "PIL_EP10_1", "alert_id": "1234a95d467f208550559cc6d8570790485fd488d42f6d60953f81bd0e376789", "data": { "device_name": "BRPIL\\PIL-EP10-1", "device_id": "12349766d866410ab1194349a4bb6789", "os_name": "Windows 10", "os_version": "10.0", "device_type": "Workstation", "is_managed": true, "ip_addresses": [ "10.200.1.101", "22.224.152.57" ] }, "relationships": [ { "relationship_type": "session", "source_entity_id": "PIL_EP10_1", "source_entity_type": "DEVICE", "dest_entity_id": "1", "dest_entity_type": "LOGON_SESSION" } ], "citations": [ { "field_name": "device_id", "source": { "type": "alert_path", "path": "device.device_id" } }, { "field_name": "os_name", "source": { "type": "alert_path", "path": "device.os_version" } }, { "field_name": "device_type", "source": { "type": "alert_path", "path": "device.product_type_desc" } }, { "field_name": "ip_addresses", "source": { "type": "alert_path", "path": "device.local_ip" } }, { "field_name": "ip_addresses", "source": { "type": "alert_path", "path": "device.external_ip" } }, { "field_name": "ip_addresses", "source": { "type": "enrichment_reference", "ref": { "timestamp": "2026-03-17T23:02:29.262066+00:00", "supporting_data_source": { "manifest": "fdr", "source": "crowdstrike_fdr_sensor-info", "source_name": "CrowdStrike Falcon Sensor-info" }, "request": { "request_type": "ab-type7", "qw_query": { "query": "rs_connectorType:'crowdstrike_fdr' AND rs_subType:'fdrv2-aidmaster' AND (aid:'12349766d866410ab1194349a4bb6789' OR ComputerName:'12349766d866410ab1194349a4bb6789')", "start_timestamp": 1745250599, "end_timestamp": 1745855399, "sort_by": "rs_timestamp" }, "meta": { "start_timestamp": "2025-04-21T15:49:59+00:00", "end_timestamp": "2025-04-28T15:49:59+00:00", "connector_source_name": "CrowdStrike Falcon Sensor-info" } }, "response": { "attachment_id": "12349304-c052-4cfe-b28f-6ec85ffa6789", "metadata": { "filename": "response.json" }, "format": "json" }, "truncated_response": { "attachment_id": "12349304-c052-4cfe-b28f-6ec85ffa6789", "metadata": { "filename": "response.json" }, "format": "json" } } } } ], "holistic_enrichments": [] } } ], "rs_alertBrief": { "summary": "An unlikely travel event was detected for user 'John Doe' (john.doe@blastradiuslabs.com) with a sign-in attempt from IP '192.168.0.1' in Surabaya, Indonesia, while a related location was identified in Switzerland with IP '::1'. The activity was flagged as medium risk by Microsoft Entra ID Protection.", "intent": "Access user account using compromised credentials from an unusual location." } } ``` #### **Connector status error payload** This payload is generated when a connector reports an error status. ```json { "rs_connectorType": "sentinelone_alert_source", "rs_connectorTypeName": "SentinelOne Alerts & Sensor Info", "rs_connectorVendorName": "SentinelOne", "rs_outcome": "CredentialsError", "rs_errorMessage": "unauthorized error: Request failed with status code 401", "rs_tenantDisplayName": "Test Tenant", "rs_webhookTriggerType": "Connector Status Error", "rs_webhookTriggerTimestamp": "2026-06-19T13:32:08.246Z" } ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.radiantsecurity.ai/export-logs/outgoing-webhooks/set-up-outgoing-webhooks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.