Falcon Fusion SOAR Alerts

LogScale supports sending events to Fusion SOAR through webhooks.

Using a webhook, an alert in LogScale can send a notification to Fusion SOAR, which in turn can generate a message to your staff or perform other actions available through their service.

To receive events from LogScale in Fusion SOAR, you will need to set up a inbound webhook trigger. In Fusion SOAR:

  1. Go to Fusion SOAR โ†’ Fusion SOAR โ†’ Workflows.

  2. Click Create workflow, select how to create the workflow, and continue to the workflow canvas.

  3. In the Add trigger panel, click Inbound webhook.

  4. Enter a name and optionally a description.

  5. Select the HTTP method.

  6. Select the authentication type.

    Anyone trying to start the workflow from an external system will have to provide any authentication info entered here to trigger the workflow.

    • Basic: Enter a username and password.

    • HMAC: The hash algorithm is automatically selected. Enter a secret, select the signature encoding, and enter the signature header name, which is the header in the request, such as X-Signature, that will contain the signature.

      The message digest is used in forming the signature. The request body is always included in this digest. You can also include Timestamp and Message ID in the digest.

      When you enable HMAC authentication, for each request from a tool outside of Fusion SOAR, you must use the same hash algorithm, secret, and encoding to compute the signature that you place in the specified header.

    • API key: Enter a key and select whether the key will be found in the requests' header or body.

  7. Complete the fields for the chosen authentication type.

  8. Optional. If you would like to set a particular response body or response code, click Add advanced configuration and enter the desired info.

    By default, the response body is empty and the response code is 200.

  9. Optional. To improve the security of the trigger, configure a range of IP addresses that are allowed to invoke the webhook. Click Add advanced configuration and then Allowed IPs. Enter each value as a CIDR notation IP address with a prefix length, such as 192.0.2.0/24 or 2001:db8::/32, as defined in RFC 4632 and RFC 4291.

    Note

    Fusion SOAR normalizes these values to be in expected network ranges. For example, it changes 12.13.14.15/12 to 12.0.0.0/12.

  10. Click Generate URL.

    Fusion SOAR creates the URL that you will use in an external system to trigger the current workflow.

    The generated webhook endpoint URL is specific to the workflow where its trigger was created. You cannot use the URL with other workflows.

  11. Copy the URL to immediately add to the external system or to save for later.

  12. Optional. Create a JSON schema for the request payload to enforce a format for the payload.

    You can listen for a live payload, enter a sample payload, or a combination of both.

    To view a history of webhook events and their output to use in creating the schema, click Execution history. You can filter the history for execution status and timeframe.

    Tip

    To avoid enforcing a format and just pass through the entire payload, enter empty curly braces, {}, as the sample payload. When you use this technique, the workflow execution log shows the entire webhook payload. Also, if you use this technique, you can use data transformation functions to extract or transform the webhook payload. For more info, see Fusion SOAR Data Transformation Functions.

  13. Click Next to add the trigger.

  14. Define the rest of the workflow.

In LogScale:

  1. Select a repository from the Repositories and Views tab.

  2. Navigate to the Automation tab โ†’ Actions โ†’ New action.

  3. Enter a name for the action, for example Fusion SOAR Action.

  4. Select Webhook from the Action type menu.

  5. In the Webhook action configuration form, paste your URL in the Endpoint URL field.

  6. Leave the rest of the fields default, and click Create action.

  7. Go to Automation โ†’ Triggers โ†’ New trigger.

  8. Type in the query you require, then configure the alert by setting name and throttle period.

  9. Click Save.

  10. The alert you just created will now appear in the Triggers interface.