Webhook Payload Reference

This page documents every webhook payload format the Console delivers. The format used for a given delivery depends on the webhook_type configured on the destination. All payloads are sent as HTTP POST with Content-Type: application/json and a 10-second timeout.

For Generic JSON destinations with a signing_secret, deliveries include an X-Telovix-Signature: sha256=<hex> header computed as HMAC-SHA256 over the raw request body bytes. Other destination types do not receive this header.

Payload types

The Console generates different payloads depending on which event system produces the delivery:

Source	Payload type
Alert rules (from runtime events)	`AlertDeliveryPayload` (generic, or platform-formatted for Slack/Discord/Teams/PagerDuty/OpsGenie/TheHive)
Saved search alerts	`saved_search_match` JSON for Generic JSON, or the destination's provider-specific format
Test deliveries	Test evidence formatted for the selected destination
Trust alerts (certificate renewal, revocation)	`AlertDeliveryPayload` with trust-specific `alert_kind`

Generic JSON payload (alert rules)

Used when webhook_type is generic. Unsupported destination types are rejected. Observe, Huntress, and Sumo Logic are configured separately in SIEM Integrations. Example URLs use port 15483 (Telovix self-hosted default).

json

{
  "version": "1",
  "alert_kind": "security_event",
  "severity": "high",
  "sensor_id": "sensor_3Tz8mQkLpNvXa1Yw",
  "node_name": "upf-prod-01",
  "trust_health": "not_applicable",
  "headline": "detect-priv-esc fired on upf-prod-01",
  "detail": "Process /opt/open5gs/bin/upf called setuid to root",
  "occurred_at": "2026-04-26T14:22:00Z",
  "delivered_at": "2026-04-26T14:22:01Z",
  "source": "security_event",
  "event_kind": "privilege_change",
  "rule_name": "detect-priv-esc",
  "message": "Process /opt/open5gs/bin/upf called setuid to root",
  "process": "/opt/open5gs/bin/upf",
  "parent_executable": "/bin/systemd",
  "mitre_technique": "T1548",
  "mitre_tactic": "privilege-escalation",
  "observed_at": "2026-04-26T14:22:00Z",
  "declared_role": "upf",
  "os_name": "Ubuntu",
  "os_version": "22.04",
  "architecture": "x86_64",
  "kernel_version": "5.15.0-91-generic",
  "tags": ["site:oslo", "plmn:242-01"],
  "is_contained": false,
  "group_ids": [],
  "related_event_count": 3,
  "k8s_namespace": "5g-core",
  "pod_name": "upf-0",
  "workload_type": "StatefulSet",
  "workload_name": "upf",
  "container_id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
  "ancestors": "[{\"pid\":1,\"comm\":\"systemd\"}]",
  "telecom_protocol_family": "PFCP",
  "telecom_interface_context": "N4",
  "telecom_transport_context": "UDP/8805",
  "alert_inbox_url": "https://console.example.com:15483/alerts"
}

Generic payload field reference

All timestamps are RFC3339. Optional fields are omitted when null.

Field	Always present	Description
`version`	Yes	Schema version. Currently `"1"`.
`alert_kind`	Yes	`"security_event"` for alert rule deliveries, `"test_delivery"` for test, trust alert kinds for trust events
`severity`	Yes	`"info"`, `"warning"`, `"high"`, or `"critical"`
`sensor_id`	Yes	Sensor identifier
`node_name`	Yes	Sensor display name
`trust_health`	Yes	Trust health of the sensor at delivery time, or `"not_applicable"` for security event deliveries
`headline`	Yes	Short human-readable summary
`detail`	Yes	Longer description
`occurred_at`	Yes	When the event occurred
`delivered_at`	Yes	When this delivery was sent
`source`	Yes	Internal source identifier (`"security_event"`, `"v2_api_test"`, etc.)
`event_kind`	No	Runtime event kind that triggered the alert
`rule_name`	No	Alert rule name
`message`	No	Full event message
`process`	No	Process binary path
`parent_executable`	No	Parent process binary path
`mitre_technique`	No	MITRE ATT&CK technique ID
`mitre_tactic`	No	MITRE ATT&CK tactic
`observed_at`	No	When the underlying event was observed
`declared_role`	No	NF role of the sensor (telecom flavor)
`os_name`	No	Operating system name
`os_version`	No	Operating system version
`architecture`	No	CPU architecture
`kernel_version`	No	Kernel version string
`tags`	No	Sensor tags (omitted if empty)
`is_contained`	Yes	Whether the sensor is in containment mode
`group_ids`	No	Sensor group IDs (omitted if empty)
`related_event_count`	No	Count of related events in the detection window
`k8s_namespace`	No	Kubernetes namespace
`pod_name`	No	Kubernetes pod name
`workload_type`	No	Kubernetes workload type
`workload_name`	No	Kubernetes workload name
`container_id`	No	Container ID
`ancestors`	No	JSON-encoded process ancestor chain
`telecom_protocol_family`	No	Telecom protocol (e.g., `"PFCP"`, `"NGAP"`)
`telecom_interface_context`	No	Telecom interface context (e.g., `"N4"`)
`telecom_transport_context`	No	Telecom transport context (e.g., `"UDP/8805"`)
`alert_inbox_url`	Yes	URL to the alert in the Console Alert Inbox

Slack payload

For webhook_type: "slack". Uses Slack Block Kit format. Telovix does not add an X-Telovix-Signature header to Slack deliveries.

json

{
  "text": "🚨 detect-priv-esc - upf-prod-01",
  "blocks": [
    {
      "type": "header",
      "text": { "type": "plain_text", "text": "🚨 detect-priv-esc" }
    },
    {
      "type": "section",
      "fields": [
        { "type": "mrkdwn", "text": "*Sensor:*\nupf-prod-01" },
        { "type": "mrkdwn", "text": "*Role:*\nupf" },
        { "type": "mrkdwn", "text": "*Event:*\nprivilege_change" },
        { "type": "mrkdwn", "text": "*Process:*\n/opt/open5gs/bin/upf" },
        { "type": "mrkdwn", "text": "*Severity:*\nhigh" },
        { "type": "mrkdwn", "text": "*OS:*\nUbuntu 22.04 (x86_64)" }
      ]
    },
    {
      "type": "section",
      "text": { "type": "mrkdwn", "text": "Process /opt/open5gs/bin/upf called setuid to root" }
    },
    {
      "type": "context",
      "elements": [{ "type": "mrkdwn", "text": "Telovix Console • 2026-04-26T14:22:00Z • <https://console.example.com:15483/alerts|View in Inbox>" }]
    }
  ]
}

Optional fields (MITRE, Tags, Parent, Telecom Context, K8s Context, Related (window)) are appended as additional section fields when present.

Discord payload

For webhook_type: "discord". Uses Discord Embed format.

json

{
  "content": "🚨 **detect-priv-esc** on `upf-prod-01`",
  "embeds": [{
    "title": "privilege_change",
    "description": "Process /opt/open5gs/bin/upf called setuid to root",
    "color": 15548997,
    "fields": [
      { "name": "Sensor", "value": "upf-prod-01", "inline": true },
      { "name": "Role", "value": "upf", "inline": true },
      { "name": "Process", "value": "/opt/open5gs/bin/upf", "inline": true },
      { "name": "Severity", "value": "high", "inline": true },
      { "name": "OS", "value": "Ubuntu 22.04 (x86_64)", "inline": true }
    ],
    "timestamp": "2026-04-26T14:22:00Z",
    "url": "https://console.example.com:15483/alerts"
  }]
}

The embed color 15548997 is a fixed red (#ED4245). Optional fields (Parent Process, Telecom Context, Tags, MITRE, Related, K8s, Inbox URL) are appended as additional embed fields when present.

Microsoft Teams payload

For webhook_type: "teams". Telovix sends an Adaptive Card message accepted by the configured Teams workflow endpoint.

json

{
  "type": "message",
  "attachments": [{
    "contentType": "application/vnd.microsoft.card.adaptive",
    "contentUrl": null,
    "content": {
      "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
      "type": "AdaptiveCard",
      "version": "1.2",
      "body": [
        { "type": "TextBlock", "weight": "Bolder", "size": "Medium", "wrap": true, "text": "Runtime alert on app-01" },
        { "type": "TextBlock", "wrap": true, "text": "Review the observed process activity." },
        { "type": "FactSet", "facts": [
          { "title": "Sensor", "value": "app-01" },
          { "title": "Severity", "value": "high" }
        ] }
      ]
    }
  }]
}

Available process, workload, telecom, and alert-link context is included as facts. Configure the workflow to accept this message format, then send a test from Telovix.

PagerDuty payload

For webhook_type: "pagerduty". Uses PagerDuty Events API v2 format. The signing_secret field on the destination is used as the routing_key. No X-Telovix-Signature header is sent for PagerDuty.

json

{
  "routing_key": "<pd-routing-key>",
  "event_action": "trigger",
  "dedup_key": "telovix-{rule_id}-{sensor_id}",
  "payload": {
    "summary": "detect-priv-esc fired on upf-prod-01: Process /opt/open5gs/bin/upf called setuid...",
    "severity": "error",
    "source": "upf-prod-01",
    "timestamp": "2026-04-26T14:22:00Z",
    "component": "privilege_change",
    "group": "upf",
    "class": "detect-priv-esc",
    "custom_details": {
      "event_kind": "privilege_change",
      "process": "/opt/open5gs/bin/upf",
      "message": "...",
      "declared_role": "upf",
      "is_contained": false,
      "mitre_technique": "T1548"
    }
  },
  "links": [
    { "href": "https://console.example.com:15483/alerts", "text": "View in Telovix Alert Inbox" }
  ]
}

PagerDuty severity mapping: critical - "critical", high - "error", medium - "warning", low (and all others) - "info".

The summary field is truncated to 1024 characters.

OpsGenie payload

For webhook_type: "opsgenie". The signing_secret field is used as the GenieKey API key in the Authorization header. No X-Telovix-Signature header is sent.

json

{
  "message": "detect-priv-esc - upf-prod-01",
  "description": "Process /opt/open5gs/bin/upf called setuid to root",
  "alias": "telovix-{rule_id}-{sensor_id}",
  "responders": [],
  "visibleTo": [],
  "tags": ["privilege_change", "high", "telovix", "site:oslo"],
  "details": {
    "event_kind": "privilege_change",
    "process": "/opt/open5gs/bin/upf",
    "declared_role": "upf",
    "is_contained": false
  },
  "priority": "P2",
  "source": "Telovix Console",
  "entity": "upf-prod-01",
  "actions": ["Acknowledge", "Close"]
}

OpsGenie priority mapping: critical - P1, high - P2, medium - P3, low - P4, others - P5.

The message field is truncated to 130 characters. The description field is truncated to 15000 characters. Tags include the event kind, severity, "telovix", sensor tags, and telecom protocol family when present.

TheHive payload

For webhook_type: "thehive". Creates a TheHive v5 alert via POST {target_url}/api/v1/alert. The signing_secret field is used as the Bearer API token. No X-Telovix-Signature header is sent.

json

{
  "type": "telovix-alert",
  "source": "telovix",
  "sourceRef": "telovix-{rule_id}-{sensor_id}",
  "title": "detect-priv-esc - upf-prod-01",
  "description": "**Rule:** detect-priv-esc\n**Sensor:** upf-prod-01\n**Event kind:** privilege_change\n**Severity:** high\n**Message:** ...\n**Observed at:** 2026-04-26T14:22:00Z\n\n[View in Telovix Alert Inbox](https://...)",
  "severity": 3,
  "date": 1745676120000,
  "tags": ["telovix", "privilege_change", "high"],
  "tlp": 1,
  "pap": 1
}

TheHive severity mapping: critical - 4, high - 3, medium - 2, others - 1.

The date field is a Unix timestamp in milliseconds. The title is truncated to 512 characters. tlp and pap are fixed at 1 (GREEN).

Saved search match payload

Generated when a saved search alert threshold is crossed. The following envelope is used for Generic JSON destinations. Other destinations receive their provider-specific format.

json

{
  "version": "1",
  "alert_kind": "saved_search_match",
  "search_id": "<saved_search_id>",
  "search_name": "UPF network anomalies",
  "match_count": 15,
  "window_secs": 3600,
  "threshold": 10,
  "triggered_at": "2026-04-26T14:22:00Z",
  "event_search_url": "https://console.example.com:15483/events?saved_search_id=<id>"
}

For slack destinations, the saved search alert uses Slack Block Kit text and context fields.

Signature verification

For Generic JSON destinations, configuring a signing_secret enables the X-Telovix-Signature header. Slack, Discord, and Teams do not receive this signature. PagerDuty, OpsGenie, and TheHive use this credential field for provider authentication instead.

X-Telovix-Signature: sha256=<hex-encoded-hmac-sha256>

The signature is HMAC-SHA256 computed over the raw request body bytes using the signing_secret. Always compute the HMAC over the raw body buffer before JSON parsing.

Test delivery payload

Sent by POST /api/v2/webhooks/{webhook_id}/test. Tests use the selected destination's format. For Generic JSON, the payload is:

json

{
  "version": "1",
  "alert_kind": "test_delivery",
  "severity": "info",
  "sensor_id": "test",
  "node_name": "test-node",
  "trust_health": "healthy",
  "headline": "Telovix V2 API test delivery",
  "detail": "This is a test webhook delivery from the Telovix V2 API.",
  "occurred_at": "<current_time>",
  "delivered_at": "<current_time>",
  "source": "v2_api_test",
  "is_contained": false,
  "alert_inbox_url": ""
}

Webhook Payload Reference ​

Payload types ​

Generic JSON payload (alert rules) ​

Generic payload field reference ​

Slack payload ​

Discord payload ​

Microsoft Teams payload ​

PagerDuty payload ​

OpsGenie payload ​

TheHive payload ​

Saved search match payload ​

Signature verification ​

Test delivery payload ​

Further reading ​

Webhook Payload Reference

Payload types

Generic JSON payload (alert rules)

Generic payload field reference

Slack payload

Discord payload

Microsoft Teams payload

PagerDuty payload

OpsGenie payload

TheHive payload

Saved search match payload

Signature verification

Test delivery payload

Further reading