Webhook (HMAC) — CyberCLI notification channel

Generic signed POST to any URL. Optional HMAC-SHA256; custom body templates.

Where to get it

Any HTTP endpoint you control — n8n, Node-RED, a Lambda, your own service.

Install / what you need

No install. You need a URL that accepts POST (and optionally an HMAC secret to verify it's us).

How to connect

1 Stand up an endpoint that accepts a JSON POST.
2 Open the dashboard's Notifications panel → Add destination → choose webhook, fill in the URL (+ optional HMAC secret, Pro+).
3 Optionally supply a body template to match your downstream's schema.
4 Hit Send test on the destination card and verify the HMAC signature.

When you'd use it

Pipe into n8n / Node-RED for any downstream.

Feed a custom dashboard or app.

Sign payloads so the receiver trusts the source.

What Herald sends through this channel

5 setup fields · HMAC-signed

Herald hands every alert to the WebhookAdapter as a DispatchPlan. The fields below are what the dashboard form asks for; the sample is the plan the adapter receives. The adapter renders it into the channel-native shape (Discord embeds, Teams MessageCards, PagerDuty Events-API payloads, TwiML, JSON POST bodies) on the way out — that wire transcript varies per channel.

Setup form fields

field	type	required	description / default
url	string	required	Receiver URL — POST target
hmac_secret	string	optional	If set, body is signed with HMAC-SHA256 (Pro+ feature)
timeout_seconds	number	optional	no description · default: 10
extra_headers	object	optional	no description
body_format	string	optional	Wire format for the request body. 'json' (default) sends application/json; 'form' sends application/x-www-form-urlencoded with the same fields; 'text' sends text/plain with a newline-separated key=value rendering; 'xml' sends a flat application/xml document with one <field name=...>VALUE</field> per field (added 2026-06-07 for legacy SOAR receivers). · default: "json"

Sample DispatchPlan (input to the adapter)

{
  "decision_id": "tdc-2026-06-20-abc12",
  "channel": "<channel-type>",
  "recipient": {
    "recipient_id": "soc-oncall",
    "display_name": "SOC on-call",
    "addresses": [
      {
        "channel": "<channel-type>",
        "address": "<destination>",
        "min_defcon": 5
      }
    ]
  },
  "urgency": "high",
  "retry_policy": {
    "max_attempts": 3,
    "initial_backoff_seconds": 5
  },
  "subject": "Suspicious login on CEO-LAPTOP",
  "body": "Warden flagged a PowerShell child of WINWORD.EXE. The encoded command resolved to a base64-wrapped Invoke-WebRequest to a newly-registered domain. Trust ladder: L3.",
  "approval_link": "https://app.cybercli.local/approve/abc12",
  "incident_ref": "case-2026-0142",
  "signal_id": "sig-2026-06-20-9f3"
}

Sovereignty: byo_external · Min tier (BYO): free · Generic POST; HMAC-SHA256 signing optional (Pro+).

Sovereignty

POSTs go only where you point them. HMAC-SHA256 lets the receiver prove the payload is genuinely from your CyberCLI.

Who notifies through it

Herald — the Guild's voice role — routes alerts, daily digests, and AI verdicts here, on a per-CYCON-state matrix you control. CYCON 1/2 alerts repeat until an operator acks.

The Guild →

Other Machine channels

Go deeper