Socket.dev

The Socket.dev source ingests your Socket organization's webhooks. Socket only delivers event logs by webhook, so RunReveal gives you a URL, you register it in Socket, and Socket pushes each event as it happens.

Two event groups are available in Socket's webhook form:

Organizations with Socket's threat feed entitlement can also select threat-feed and campaign events. RunReveal accepts and stores those too, along with any event type Socket adds later.

Setup

You'll move between Socket and RunReveal once: Socket's form needs RunReveal's URL, and RunReveal needs Socket's signing key. Keep the Socket tab open while you work.

https://api.runreveal.com/sources/socket/webhook/<webhook-id>

How requests are verified

Every Socket delivery carries an x-webhook-signature header of the form t=<timestamp>,s=<signature>. The signature is a base64 HMAC-SHA256 of <timestamp>.<raw request body>, keyed with your signing key. RunReveal rejects a delivery with HTTP 400 if:

• the header is missing or malformed,
• the signature doesn't match the body under your signing key, or
• the timestamp is more than five minutes from RunReveal's clock (replay protection).

The signing key is required. A Socket.dev source without one rejects every request.

Verify it's working

After the test payload, or once real alerts start arriving, query the typed view:

SELECT eventTime, eventName, severity, alertType, repository, package, alertTitle
FROM socket_logs
WHERE eventTime >= now() - INTERVAL 1 DAY
ORDER BY eventTime DESC
LIMIT 50

Pull request scans:

SELECT eventTime, repository, pullRequestNumber, branch, commitHash, scanReportURL
FROM socket_logs
WHERE eventName = 'pull-request:scan'
ORDER BY eventTime DESC
LIMIT 50

Field mapping

Socket's envelope maps onto RunReveal's normalized fields:

Socket doesn't publish a schema for the contents of data. The alert and scan columns in socket_logs follow the field names Socket uses for the same objects in its REST API (the organization alerts list and full scan metadata). The complete payload is always kept in rawLog, and the data and pullRequest columns hold the raw JSON, so fields RunReveal doesn't extract are still queryable:

SELECT JSONExtractString(data, 'alert', 'fix', 'description') AS fix
FROM socket_logs
WHERE eventName LIKE 'alert:%'

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Troubleshooting

Socket's test returns 400. The signing key in RunReveal doesn't match Socket's. Copy the key from Socket again, open the source in RunReveal, paste it into Signing Key, and save. Leaving the field blank while editing keeps the current key.

Events stop after rotating the key in Socket. Update the key in RunReveal at the same time. Deliveries signed with the new key fail until RunReveal has it.

No pull request events. pull-request:scan comes from Socket's GitHub app. Check that the app is installed on the repository and that the repository isn't excluded by the webhook's Filters.

Helpful links

• Socket webhooks: creating webhooks, payload envelope, and signature scheme
• Socket alert types: values you'll see in alertType
• Standard Webhooks: the envelope format Socket follows