Webhooks

Webhooks let Flarehawk send alert data as an HTTP POST request to any HTTPS endpoint you control. When a detection rule fires an alert, Flarehawk delivers a structured JSON payload to your endpoint — immediately and without polling. This makes webhooks the right choice for connecting Flarehawk to incident management tools like PagerDuty and incident.io, or to a custom pipeline you build yourself.

Adding a webhook endpoint

Open notification settings

In the Flarehawk dashboard, navigate to Settings and click the Notifications tab.

Enable the webhook channel

Toggle the webhook channel on.

Enter your endpoint URL

Paste the HTTPS URL of your endpoint in the Webhook URL field. The URL must be publicly reachable — private IP addresses, localhost, and internal hostnames are rejected.

Add custom headers (optional)

If your endpoint requires authentication, add headers such as Authorization: Bearer <your-token> in the Custom headers section. These headers are sent with every webhook request.

Save and test

Click Save, then send a test notification to confirm your endpoint receives the payload.

Only organization admins can configure webhook endpoints.

Payload format

Flarehawk sends a POST request with Content-Type: application/json and the following payload structure. All fields are present on every delivery; optional fields that have no value are omitted.

{
  "event_type": "incident_created",
  "incident_id": "01HXYZ9K3BQMR4V7WNJE5F6G8D",
  "organization_id": "org-4a3f9c12-8b7e-4d1a-b0f2-c9d3e5a7f81b",
  "organization_name": "Acme Corp",
  "asset_id": "domain-7e2c1a09-3f4b-48d2-a9e6-b1c5d8f3e04a",
  "domain_display_name": "api.acme.com",
  "domain_name": "api.acme.com",

  "severity": "high",
  "attack_category": "auth_attack",
  "attack_category_label": "Auth Attack",
  "alert_count": 47,

  "title": "Acme Corp: New high Incident on api.acme.com (Auth Attack)",
  "summary_one_line": "Credential stuffing burst detected on login endpoint",
  "summary": "A sudden spike in failed authentication attempts was detected on api.acme.com, with 47 individual alerts firing within the cooldown window. The pattern matches credential stuffing behavior originating from 12 distinct source IPs.",
  "summary_short": "A sudden spike in failed authentication attempts was detected on api.acme.com, with 47 individual alerts firing within the cooldown window.",
  "primary_narrative": "A sudden spike in failed authentication attempts was detected on api.acme.com, with 47 individual alerts firing within the cooldown window.",

  "incident_title": "Credential Stuffing Attack on Login Endpoint",
  "incident_review": "Flarehawk identified a coordinated credential stuffing campaign targeting the /auth/login endpoint. Source IPs show low request overlap and short session durations consistent with automated tooling.",
  "ai_root_cause": "Automated credential stuffing tooling is rotating through a leaked credential list. The low per-IP request rate suggests the attacker is evading simple rate limits.",
  "ai_mitigation_plan": "Enable CAPTCHA on the login endpoint and add IP-based rate limiting at the WAF layer. Consider requiring MFA for all accounts that received failed login attempts in the past 24 hours.",
  "ai_immediate_actions": [
    "Block the top 12 source IPs at the WAF",
    "Force password reset for accounts with more than 3 failed attempts in the last hour"
  ],
  "ai_preventive_measures": [
    "Enable adaptive rate limiting on the authentication endpoint",
    "Integrate a threat intelligence feed to automatically block known credential stuffing infrastructure"
  ],

  "highlights": [
    { "type": "metric", "label": "Failed auth attempts", "value": "47" },
    { "type": "metric", "label": "Distinct source IPs", "value": "12" },
    { "type": "metric", "label": "Observed rate (req/min)", "value": "94" },
    { "type": "metric", "label": "Baseline rate (req/min)", "value": "8" }
  ],

  "triggered_at": "2026-05-23T14:32:07.000Z",

  "incident_url": "https://app.flarehawk.com/incidents/01HXYZ9K3BQMR4V7WNJE5F6G8D",
  "acknowledge_url": "https://app.flarehawk.com/incidents/01HXYZ9K3BQMR4V7WNJE5F6G8D?quick_action=acknowledge",
  "mitigate_url": "https://app.flarehawk.com/incidents/01HXYZ9K3BQMR4V7WNJE5F6G8D?quick_action=mitigate",
  "dashboard_url": "https://app.flarehawk.com"
}

{
  "event_type": "incident_resolved",
  "incident_id": "01HXYZ9K3BQMR4V7WNJE5F6G8D",
  "organization_id": "org-4a3f9c12-8b7e-4d1a-b0f2-c9d3e5a7f81b",
  "organization_name": "Acme Corp",
  "asset_id": "domain-7e2c1a09-3f4b-48d2-a9e6-b1c5d8f3e04a",
  "domain_display_name": "api.acme.com",
  "domain_name": "api.acme.com",

  "severity": "high",
  "attack_category": "auth_attack",
  "attack_category_label": "Auth Attack",
  "alert_count": 47,

  "title": "Acme Corp: Incident Resolved on api.acme.com (Auth Attack)",
  "summary_one_line": "Credential stuffing burst resolved",
  "summary": "The elevated failed authentication rate on api.acme.com has returned to baseline. The incident is now resolved.",
  "summary_short": "The elevated failed authentication rate on api.acme.com has returned to baseline.",
  "primary_narrative": "The elevated failed authentication rate on api.acme.com has returned to baseline. The incident is now resolved.",

  "highlights": [
    { "type": "metric", "label": "Failed auth attempts", "value": "47" },
    { "type": "metric", "label": "Distinct source IPs", "value": "12" }
  ],

  "triggered_at": "2026-05-23T14:32:07.000Z",

  "incident_url": "https://app.flarehawk.com/incidents/01HXYZ9K3BQMR4V7WNJE5F6G8D",
  "acknowledge_url": "https://app.flarehawk.com/incidents/01HXYZ9K3BQMR4V7WNJE5F6G8D?quick_action=acknowledge",
  "mitigate_url": "https://app.flarehawk.com/incidents/01HXYZ9K3BQMR4V7WNJE5F6G8D?quick_action=mitigate",
  "dashboard_url": "https://app.flarehawk.com"
}

Event types

The event_type field tells you what triggered the notification:

Value	When it fires
`incident_created`	A detection rule fires and creates a new incident
`incident_escalated`	An existing incident is escalated to a higher severity
`incident_resolved`	An incident is closed and returns to baseline
`remediation_suggested`	Flarehawk generates an automated remediation recommendation
`remediation_applied`	A remediation rule is applied to the domain

Severity values

The severity field is one of low, medium, high, or critical.

Webhook delivery and retries

Flarehawk considers a delivery successful when your endpoint returns a 2xx HTTP status code. If your endpoint returns any other status code or does not respond, Flarehawk retries the delivery automatically. Deliveries that fail after all retries are recorded but not re-queued indefinitely. To minimize failed deliveries:

Ensure your endpoint responds within a reasonable timeout.
Return 200 OK as quickly as possible. If you need to process the payload asynchronously, acknowledge receipt immediately and process in the background.
Avoid returning 5xx errors transiently — they consume retry attempts.

Test your endpoint response handling with the test notification in Settings → Notifications before relying on it for production alerts.

Custom headers

You can add any HTTP request headers to webhook deliveries in the Custom headers field in Settings → Notifications. Headers are useful for authentication tokens, routing keys, or content negotiation. For example:

{
  "Authorization": "Bearer your-secret-token",
  "X-Source": "flarehawk"
}

Do not include headers that control transport behavior (Host, Cookie, Transfer-Encoding, Content-Length, Connection). Flarehawk strips these for security reasons and they will not be sent.

Provider-specific formatting

Flarehawk automatically detects certain well-known webhook destinations and reformats the payload for their native API:

Destination	Behavior
PagerDuty (`events.pagerduty.com`)	Formatted as a PagerDuty Events API v2 trigger or resolve event, with severity mapped to PagerDuty’s `critical` / `error` / `warning` / `info` scale
Discord (`discord.com/api/webhooks`)	Formatted as a Discord embed with color-coded severity
Microsoft Teams (`webhook.office.com`)	Formatted as a Teams MessageCard with fact tables and action links
All other endpoints	Standard JSON payload as documented above

Common integrations

PagerDuty

Use your PagerDuty Events API v2 integration URL as the webhook endpoint. Flarehawk automatically formats the payload for PagerDuty, mapping incident_created and incident_escalated to trigger events and incident_resolved to a resolve event. The dedup_key is set to flarehawk-{incident_id} so PagerDuty correctly correlates resolution events with the original incident.In PagerDuty, create a service with an Events API v2 integration and copy the endpoint URL into Flarehawk’s webhook settings.

incident.io

Create an Incoming webhook alert source in incident.io and paste the generated URL into Flarehawk’s webhook settings. Use the standard Flarehawk payload — incident.io accepts generic JSON and lets you map fields to its alert schema in the alert source configuration.

Custom HTTPS endpoints

Any publicly reachable HTTPS endpoint works as a Flarehawk webhook destination. Your handler receives a POST request with Content-Type: application/json. Use the Authorization custom header to authenticate requests. Respond with 200 OK to acknowledge receipt.

Testing your webhook

Send a test delivery at any time from Settings → Notifications. The test sends a sample incident_created payload to your configured endpoint using the same delivery path as real alerts. Check your endpoint’s logs or response for confirmation.

Test payloads use synthetic data and do not correspond to real incidents. They are intended only to verify that your endpoint is reachable and that Flarehawk’s configuration is correct.

Get Started

Core Concepts

Dashboard

Notifications

Detection

Flarehawk Intel

Billing

Adding a webhook endpoint

Payload format

Event types

Severity values

Webhook delivery and retries

Custom headers

Provider-specific formatting

Common integrations

Testing your webhook

​Adding a webhook endpoint

​Payload format

​Event types

​Severity values

​Webhook delivery and retries

​Custom headers

​Provider-specific formatting

​Common integrations

​Testing your webhook

Adding a webhook endpoint

Payload format

Event types

Severity values

Webhook delivery and retries

Custom headers

Provider-specific formatting

Common integrations

Testing your webhook