SaaS Security Administrator's Guide
    : Send SSPM Notifications to Webhooks
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. SaaS Security Posture Management
    5. Assess Posture Security
    6. Monitor Posture Security
    7. Send SSPM Notifications to Webhooks
    Download PDF

    SaaS Security Administrator's Guide

    Send SSPM Notifications to Webhooks

    Table of Contents

    Send SSPM Notifications to Webhooks

    Learn how to send SSPM notifications to another application's incoming webhooks.
    You can configure SSPM to send notifications to a channel in Slack or Microsoft Teams. To do this, you first create an incoming webhook in Slack or Microsoft Teams for the channel. Refer to the Microsoft documentation or the Slack documentation for more instructions on creating incoming webhooks in these applications. When you create a webhook in these applications, the applications provide you with a URL that external applications can use to post messages. To enable SSPM to send notifications to a Slack or Microsoft Teams channel, you provide SSPM with the webhook URL for that channel.
    Prerequisite: Before completing the following steps, create an incoming webhook for a Slack or Microsoft Teams channel. Copy the incoming webhook URL that the application provides.
    1. Select SettingsAlerts & Notifications.
      The Alerts & Notifications page lists all of the webhooks for your tenant.
    2. To add a new webhook, Create Webhook.
    3. Fill in the fields of the Create Webhook dialog.
      1. Provide a Name for the webhook, and select the App Type.
      2. Specify the incoming Webhook URL that you obtained from Slack or Microsoft Teams.
    4. Test Webhook to verify that SSPM can post messages to it.
      If the webhook test fails, verify that the Webhook URL is correct and reachable.
    5. If the webhook test succeeds, Save Webhook.
      Your new webhook is added to the table of webhooks on the Alerts & Notifications page. From the table of webhooks, you can enable or disable a webhook, edit a webhook, and delete a webhook.
      When a webhook is enabled, SSPM can send notifications to the webhook URL. SSPM will send notifications when applications are onboarded or deleted, the first time an application is scanned, and when scans detect changes to an application's configuration settings. The notifications are displayed in the Slack or Microsoft Teams channel that is associated with the webhook URL.
      The status column of the table indicates whether SSPM can send notifications to the webhook. SSPM displays the following status values for webhooks:
      StatusMeaning
      Active
      SSPM can connect to the webhook to send notifications.
      Registered
      The webhook was recently created or re-enabled in SSPM and is becoming Active.
      Unhealthy
      Recent attempts to connect to the webhook were unsuccessful, but SSPM will continue trying. Verify that the webhook URL is reachable and that the webhook is accepting incoming notifications. To test the webhook, select the edit icon in the Actions column and Test Webhook. This might be a temporary problem, but if attempts to connect to the webhook URL continue to fail, SSPM will set the webhook status to Down.
      DisabledThe webhook is not enabled. To enable the webhook, position the Enabled toggle to the on position.
      DownMultiple consecutive attempts to connect to the webhook were unsuccessful. Verify that the webhook URL is reachable and that the webhook is accepting incoming notifications. To test the webhook, select the edit icon in the Actions column and Test Webhook.

    © 2024 Palo Alto Networks, Inc. All rights reserved.