Set up a webhook

Webhooks are a lightweight solution for ingesting alerts from your organization into the Google Security Operations SOAR platform. 

Webhook-ingested alerts appear in the platform with the same information as alerts ingested using connectors.

Google recommends using either a connector or a webhook from the same source, but not both, to avoid creating duplicate cases.

Webhooks are best for scenarios that require basic mapping logic, while connectors are better for advanced and flexible mapping.

Set up a webhook to ingest alerts

The following use case focuses on using CrowdStrike as the platform through which to ingest alerts.

To set up a webhook to ingest alerts, follow these steps:

1. Go to SOAR Settings > Ingestion > Webhooks.
2.  Click add Add incoming Webhook.
3. Enter a name for the new webhook, and choose an environment.
4. Click Save.
This example uses CrowdStrike.
After saving, it appears on the main page.

5. Copy the webhook URL and note it for later use. You'll need it to enter it in the CrowdStrike platform as the webhook destination.
   

Map data

1. In the Data Mapping section, click Upload JSON sample (use the sample taken from CrowdStrike).
2. Map the Google Security Operations fields with the corresponding fields in the CrowdStrike JSON fields. For example, the mandatory Google SecOps alert field StartTime, select the CrowdStrike field Detections.Last.Update. This appears in the Expression Builder. For more information, see Use the Expression Builder.
   Add a function (on the side) to further refine this field, for example, Date Format.
3. Once the Detections.Last.Format appears in the Expression Builder, click Run to see the results.
   The Start displays with a green checkmark, indicating that the field is mapped.
4. After you map all the necessary fields, click Save and then enable the webhook.

Test the webhook

The Testing area lets you test the webhook's end-to-end functionality, and provides detailed error descriptions. 

1. In the Testing tab, copy the webhook URL.
2. Upload a JSON file with the relevant data.
3. Click Run. The results display together with the output.

Use case: Configure the CrowdStrike platform

This use case takes you through the steps in CrowdStrike for the webhook to start ingesting alerts into the Google SecOps platform.

1. In the CrowdStrike Falcon dashboard, go to the Falcon store and install the Webhooks add-on.
2. Configure the webhook with the name and the webhook URL that you copied from the Google SecOps platform and click Save.
   
3. Go to the Workflows section.
4. Click Create a Workflow.
5. Select a trigger, such as New detection, and click Next.
6. Select Add Action.
7. In the Customize action section, select Notifications from the Action type menu and select Call webhook from the Action menu.
8. Select the name you added in the initial step and all necessary fields, and then click Finish.