Custom Events Webhook

Send events from unsupported data sources to Radiant Security

The Custom Events Webhook lets you send events from data sources that don't have a dedicated Radiant connector into the platform using a standard HTTP POST request. Events must be valid JSON and are available for searching in Log Manager under the connector type custom_events_webhook. Where a dedicated connector exists for your data source, use it instead - dedicated connectors provide richer context and full AI triage processing.

Note: Events received through the Custom Events Webhook bypass AI alert triage processing. Successfully parsed events appear in the Log Manager parsed index. Events that fail parsing appear in the unparsed index.

Prerequisites

Before you configure the Custom Events Webhook, confirm you have:

• Access to the data source or system that will send events to the webhook endpoint
• The ability to make outbound HTTP POST requests from that source to the Radiant API endpoint

Add the connector in Radiant

1. Log in to Radiant Security.
2. From the navigation menu, select Settings > Data Connector and click + Add Connector.
3. Select Custom Events Webhook from the list and click Data Feeds.
4. Under Select your data feeds, select Custom Events Webhook and click Credentials.
5. In the Credential Name field, enter an identifiable name for this credential (for example, Custom Events Webhook Credentials).
6. Under Required Credentials, enter a value in the Connector tag field. This can be any string. Radiant uses this value as salt when generating the authentication token for your connector.
7. Click Add Connector.
8. Open the newly created connector. Under Vendor Configuration, copy and save the Webhook URL and Token values. You will need both in the next section.
9. Click Add Connector to save your changes.

Send events to the webhook

Once the connector is configured, your data source sends events to the Radiant webhook endpoint using the following specification.

Important Note: Treat the Token value as a secret. Anyone with access to this token can post events to your connector. Do not expose it in client-side code or shared logs.

Request details

Component	Value
Method	POST
URL	US region: https://api.app.blastradius.ai/connectors/custom_events_webhook/webhook EU region: https://api.app.eu1.radiantsecurity.ai/connectors/custom_events_webhook/webhook
Header	Key: authorization Value: The token copied from the Data Connectors configuration screen in step 8 of the Add the connector in Radiant section
Request body	The request body must be valid JSON. Nested objects and lists are supported. timestamp is a required field with the value in epoch seconds (seconds since 1970-01-01 00:00:00 UTC) All other fields are optional, and serve as additional key-value pairs describing the event Additional fields are allowed that conform to JSON syntax

Example request body

{
  "timestamp": 1773270998,
  "event_name": "Outbound connection to external IP",
  "user_email": "[e-mail]",
  "ip_address": "192.168.1.1",
  "port": 12345,
  "bytes": 6789
}

Verify ingestion

After your Custom Events Webhook begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"custom_events_webhook".
3. Confirm recent events appear.

Allow several minutes for events to be parsed, indexed, and available for search.