Integrate Prisma Cloud DSPM with Webhooks

A webhook is an architectural strategy that configures applications and services to send a web-based message request every time a qualifying event happens. Webhook messages can be sent in various formats, and you can integrate your preferred webhook-receiving platform’s URL to receive real-time notifications on risks and alerts.

Prerequisite

We recommend verifying in advance if any additional URL headers are required when providing your SIEM/SOC platform’s webhook URL.

Integration

1. In Prisma Cloud DSPM, go to Settings > Integrations.
2. Under Notifications, select Webhooks and click Connect.
   
3. Enter your webhook-receiving platform’s URL.
   Note

   Webhook URL can be in an IP format with high port definitions in the following format: https://<IP>:<port>. Supported high values are 12465-12475 and 8443. Other high port values are not supported.
4. Under Notified On, select whether you want to be notified on Alerts, Risks, or All.
   Note

   If you wish, you can set different logic for risks and alerts by setting up two different integrations. For example, you can send all alert severity levels to your SIEM Platform, and send Medium and above risks to a different platform.

5. Check the Validate Certificate box (checked by default). Unchecking this box will disable SSL certificate validation and work with a self-signed certificate. Uncheck this box only if you trust the server identity.
6. Select the Severity Threshold for receiving notifications. The recommended severity is Medium and above.
   
7. If additional headers are required by the service you are connecting (usually for authentication reasons), click + Add headers and enter the Key and Value for each added header.
8. Click Create.
   To verify you successfully managed to integrate this webhook, you will receive a webhook notification containing a "Hello" message.
   Integrate your preferred webhook-receiving platform’s URL to receive real-time notifications on risks or alerts, or both.

Examples of risks and alerts sent from Prisma Cloud DSPM

Example of Webhook Alert body sent from Prisma Cloud DSPM

{
  "timestamp": 1700558955.309811162,
  "alertName": "Production data asset deleted",
  "actor": "smokey-assumed",
  "target": "smokey-dynamodb-on-demand-0u82f2k2s1",
  "project": "Sandbox Client 1",
  "projectLabel": "PRODUCTION",
  "severity": "Low",
  "category": "ATTACK",
  "targetIdentifier": "arn:aws:dynamodb:eu-central-1:454968046599:table/smokey-dynamodb-on-demand-0u82f2k2s1",
  "cloud": "AWS",
  "serviceType": "DynamoDB",
  "alertId": 269756357,
  "region": "eu-central-1",
  "description": "Deleting production data assets is both the culmination of an attack on a data asset, as well as a stealth tactic used by attackers to delete assets that were created as part of the attack. This policy triggers an alert when an asset is deleted from a project that is tagged as 'Production' in Prisma Cloud DSPM.",
  "assetTags": {},
  "assetDigTags": {},
  "assetLabels": [],
  "investigationLink": "https://dashboard.dev-2.dig.security/company/2001/alerts/269756357"
}

Example of Webhook Risk body sent from Prisma Cloud DSPM.

{
  "riskName": "Sensitive asset without automatic backups",
  "severity": "Low",
  "affects": "Security and Compliance",
  "assetName": "digsecuritye672be0fdb58",
  "assetId": "/subscriptions/cc9aa240-08f4-4a1c-9586-faec8a3ef048/resourcegroups/dig-security-rg-acf9c7a/providers/microsoft.storage/storageaccounts/digsecuritye672be0fdb58",
  "investigationLink": "https://dashboard.dev-2.dig.security/company/2001/risks/findings/269609916?pageNumber=1&pageSize=15&sort=riskDefinitionSeverity%7Cdesc&riskDefinitionNameIn=Sensitive+asset+without+automatic+backups&affectedAssetNameContains=digsecuritye672be0fdb58",
  "status": "Open",
  "project": "Sandbox-Client-1",
  "projectLabel": "Production",
  "firstDetectedOn": "2023-11-21T08:11:21.646Z",
  "serviceType": "Storage Account",
  "cloud": "AZURE",
  "region": "westeurope",
  "assetTags": {
    "dig-security": "true"
  },
  "assetDigTags": {
    "QA": [
      "QA"
    ],
    "test3": [
      "test4"
    ],
    "Staging": [
      "Env"
    ],
    "Test": [
      "qa",
      "test2"
    ]
  },
  "remediateInstruction": null,
  "assetLabels": [
    "PHI",
    "PII",
    "PCI",
    "Developer Secrets",
    "Sensitive"
  ],
  "additionalInfo": "Data Type Groups: PII, PHI, PCI, Developer Secrets, Sensitive",
  "description": "Automatic backup plans ensure that the data within the asset is recoverable in the event of a disaster or a malicious attack. In addition, many compliance standards require automatic backups for all assets containing sensitive or business data."
}

If you chose to receive Alert notifications, below is a list of the Alert parameters:

If you chose to receive Risk notifications, below is a list of the Risk parameters:

Once you add a webhook URL, it is listed at the bottom of the page under Webhooks. From there, you can edit the Notified On column or remove this webhook URL by clicking the X on the right.