RunReveal will send HTTP POST request to a URL of your choosing along with the data that is associated with the detection.

Set this up using the Notification page in the RunReveal dashboard.


The following shows the schema of the data that is sent in the webhook.

PropertyData TypeDescription
titlestringThe template title that was rendered.
messagestringThe template body that was rendered.
queryscheduled query responseThe field will be null if the notification was created from a trigger. Otherwise it will contain the data of the scheduled query.