Configure Webhook

As of the October 2020 release (OC2020.10), we support Webhook Beat with OneLogin (www.onelogin.com) and Zoom (https://marketplace.zoom.us/), which includes log parsing through Open Collector. Webhook Beat will have a URL to use for streaming logs from various platforms.

Configure Webhook in the OneLogin Portal

For more information on adding an Event Webhook in OneLogin, see the OneLogin documentation on sending event data to your SIEM.

1. Log on to the OneLogin portal.
2. On the Developers tab click Webhooks.

3. Click NewWebhook.
   The New Webhook dialog box appears.

4. Select Event webhook for log management.
5. Enter the following details:
   
   • Name: Logrhythm
   • Format: SIEM (NDJSON) , JSON Array - Compact and Json Array. (Choose any one format)
   • Listener URL: Provide the API endpoint URL. This endpoint URL is the same API URL that the webhookbeat provides and will be used by Onelogin portal to send POST requests with the payload of real time generated events in  Onelogin portal.
     

     

6. Click Save.

You are now able to receive logs at the provided URL.

Configure Webhook in the Zoom Portal

1. Log on to the Zoom portal.
2. In the top-right corner click Develop, and then click Build App.
3. In the Webhook Only app square, click Create.
   

   

   
   
4. Enter an App Name, and click Create.
   

   

5. Specify the following App Information:
   
   • App Name: The App Name you entered above.
   • Short Description: A short description of your webhook.
   • Company Name: Your company name.
   • Developer Name: Name of person Zoom can contact.
   • Developer Email Address: Email of person Zoom can contact.
     

     

6. Click Continue, and then click the toggle switch to enable Event Subscriptions.
   

   

   
   

7. Click Add new event subscription, and enter the following information:

   • Subscription Name: For example, Logrhythm.

   • Event notification endpoint URL: Provide the API endpoint URL. This endpoint URL is the same API URL that the webhookbeat provides and will be used by Zoom portal to send POST requests with the payload of real time generated events in  Zoom portal.

     

     Event Notification Endpoint URLs must be secured over HTTPS.
8. Click Add events and subscribe to all the applicable Webhook Events.
   

   

9. Click Save, and then click Continue.

   

   A verification token will be generated in the Feature page after you enable and save the event subscription. This token can be used to validate the POST requests that are sent by Zoom to your event notification endpoint URL.

   
   

   

   
   

10. Click Activation to activate your newly created Webhook Only App.