Help Triggering a SOAR Webhook

Question

Hi All,

Has anyone had success triggering a SOAR webhook? Whenever I try to trigger it, I get server errors. I know that it is able to resolve the host and attempts to upload the data, but the request seems to fail no matter what I try in terms of Headers or Body elements.

Errors:

HTTP/1.1 500 Internal Server Error

What I have tried:

Created the webhook in SOAR Settings → Ingestion → Webhooks.
Saved the Webhook URL
Attempted to create a sample event using POST requests with dummy data and empty request bodies
Attempted to add in a Google API key with access to Chronicle

I have also looked at the documentation, but it doesn’t have any information on triggering the webhook or what JSON data is required: https://docs.cloud.google.com/chronicle/docs/soar/ingest/webhooks/setting-up-a-webhook

Any help would be appreciated, TIA!

cmorris · Accepted Answer

Did you fill out the Data Mapping section for the webhook? Are all of the Mandatory fields mapped?

The RuleGenerator mapping will be the name of the case and the Name mapping will be the name of the alert. The Name mapping needs to be unique for a new case to be created.

_K_O · Answer

​@cmorristhanks for nudging me to go look at the mappings again.It was an issue with the mapping (incorrect field was being mapped) as well as the way the data was being sent. One thing that I didn’t take into account initially was the requirement for JSON Encoding the data fields based on the tool that I was using.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded