Webhooks

{
  "title": "RunReveal Detection Alert: Impossible Travel Detected",
  "body": "User [email protected] logged in from two countries within 5 minutes.\n\nSeverity: high\nRows Returned: 1\nResult Link: https://app.runreveal.com/dash/history?alertID=abc123",
  "channel": "webhook",
  "detection": {
    "id": "abc123",
    "detectionID": "det_456",
    "workspaceID": "ws_789",
    "name": "impossible-travel",
    "displayName": "Impossible Travel Detected",
    "detectionType": "query",
    "severity": "high",
    "riskScore": 80,
    "categories": ["identity"],
    "mitreAttacks": ["T1078"],
    "mitreTechniques": ["Valid Accounts"],
    "description": "Detects logins from geographically distant locations.",
    "system": false,
    "executedAt": "2025-02-19T12:00:00Z",
    "triggered": true,
    "resultLink": "https://app.runreveal.com/dash/history?alertID=abc123",
    "query": "SELECT actor, srcIP, srcCity FROM events WHERE ...",
    "params": { "from": "2025-02-19T11:00:00Z", "to": "2025-02-19T12:00:00Z" },
    "runTime": 230,
    "resultCount": 1,
    "nextRunTime": "2025-02-19T12:15:00Z",
    "prevRunTime": "2025-02-19T11:45:00Z",
    "results": [
      {
        "__alertID__": "abc123",
        "__columns__": ["actor", "srcIP", "srcCity"],
        "actor": "[email protected]",
        "srcIP": "203.0.113.42",
        "srcCity": "London"
      }
    ],
    "columns": ["actor", "srcIP", "srcCity"],
    "values": [
      ["[email protected]"],
      ["203.0.113.42"],
      ["London"]
    ]
  }
}

{
  "title": "RunReveal Notification Test",
  "body": "Your notification channel was tested successfully.",
  "channel": "webhook",
  "test": {
    "status": true
  }
}

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "encoding/hex"
    "testing"
)
 
func VerifyWebhook(signingKeyHex, timestamp, integrity string, body []byte) bool {
    keyBytes, err := hex.DecodeString(signingKeyHex)
    if err != nil {
        return false
    }
    mac := hmac.New(sha256.New, keyBytes)
    mac.Write([]byte(timestamp))
    mac.Write(body)
    expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))
 
    a, _ := base64.StdEncoding.DecodeString(integrity)
    b, _ := base64.StdEncoding.DecodeString(expected)
    return hmac.Equal(a, b)
}
 
// TestVerifySha256 runs a known-good example. The key below is for the example only.
// Run: go test -run TestVerifySha256 -v
func TestVerifySha256(t *testing.T) {
    integrity := "iIQEca5cWt6kzKxtjKzBwNYoqRYwcPt2C/2G7VxaglM="
    bodyPlusTime := `1720198139{"link":"https://app.runreveal.com/dash/detections/","message":"Yay! Your notification channel was tested successfully.","rawEvent":null,"test":{"status":true},"title":"RunReveal Notification Test"}`
    key := "b0c374a4fbfec3ad6047495ca83b4df3d428ed100f51462683c96dcefd74998e"
 
    keyBytes, err := hex.DecodeString(key)
    if err != nil {
        t.Fatal(err)
    }
    mac := hmac.New(sha256.New, keyBytes)
    mac.Write([]byte(bodyPlusTime))
    resultHash := base64.StdEncoding.EncodeToString(mac.Sum(nil))
 
    a, _ := base64.StdEncoding.DecodeString(integrity)
    b, _ := base64.StdEncoding.DecodeString(resultHash)
    if !hmac.Equal(a, b) {
        t.Fatalf("integrity check failed: expected match for key+bodyPlusTime")
    }
}

import hmac
import hashlib
import base64
 
def verify_webhook(signing_key_hex: str, timestamp: str, integrity: str, body: bytes) -> bool:
    key = bytes.fromhex(signing_key_hex)
    message = timestamp.encode() + body
    computed = base64.b64encode(
        hmac.new(key, message, hashlib.sha256).digest()
    ).decode()
    return hmac.compare_digest(integrity, computed)
 
# test_verify_sha256 runs a known-good example. The key below is for the example only.
# Run: python3 examples/webhook_verify/webhook_verify_test.py
def test_verify_sha256():
    integrity = "iIQEca5cWt6kzKxtjKzBwNYoqRYwcPt2C/2G7VxaglM="
    body_plus_time = '1720198139{"link":"https://app.runreveal.com/dash/detections/","message":"Yay! Your notification channel was tested successfully.","rawEvent":null,"test":{"status":true},"title":"RunReveal Notification Test"}'
    key = "b0c374a4fbfec3ad6047495ca83b4df3d428ed100f51462683c96dcefd74998e"
 
    key_bytes = bytes.fromhex(key)
    result_hash = base64.b64encode(
        hmac.new(key_bytes, body_plus_time.encode(), hashlib.sha256).digest()
    ).decode()
 
    assert hmac.compare_digest(integrity, result_hash)