Notifications

View and set up security notifications.

The Notifications tab allows you to configure HTTP-based alerts for when Secure Application detects new vulnerabilities or attacks.

Set up notifications

Set up notifications first so that Secure Application can notify your team as soon as instrumented applications start reporting vulnerabilities or attacks.

Notifications allow third-party platforms to ingest information through webhooks. Currently, Secure Application only supports HTTP-based notifications.

Create a rule to send a notification:

  1. Select Application Security > Notifications > Create notification rule.

  2. Specify settings for the new rule:

    • Rule type: Select Vulnerability or Attack.

    • Rule name: Name of the rule.

    • URL: Endpoint to deliver the notification to.

    • Bearer token:

      To send notifications to Splunk Cloud or Splunk Platform

      1. Generate an HTTP Event Collector (HEC) token that allows access to your account. To learn more, see Set up and use HTTP Event Collector in Splunk Web.

      2. Paste the HEC token you generated into the Bearer token field. Example: Splunk hec-token.

      To send notifications to other platforms

      Enter the Authorization: Bearer header value (token) for your webhook URL auth.

    • Environment: List of allowed environments as a filter. Optional.
    • Service: List of allowed services as a filter. Optional.
  3. Select Activate.

For details on the JSON payload of a notification see How notifications work.

How notifications work

The Secure Application agent sends library dependency information to Secure Application. Certain conditions related to this information trigger a notification, such as:

  • Secure Application identifies a new vulnerability match.
  • A matched library disappears (due to an upgrade).
  • Secure Application finds a new vulnerability on an existing library.

  • Secure Application identifies an attack with an outcome of Exploited.

When a notification is triggered, Secure Application delivers that notification directly to the endpoint you specified when you set up the notification rule. Your specified endpoint receives a predefined JSON payload containing information about the security event. For attacks, this notification includes the associated business transaction, if available.

Sample JSON payload
JSON 
{
  "attackName": "00002347",
  "attackStatus": "OPEN",
  "attackSource": "UNKNOWN",
  "attackOutcome": "EXPLOITED",
  "attackTypes": "{SQL}",
  "eventTrigger": "SELECT * FROM users WHERE name = '' OR *=* --'",
  "environment": "lab0",
  "service": "payment-service",
  "businessTransactionName": "payment-service:GET /api/v1",
  "lastDetected": "2026-08-06 17:14:05.00023 +0000 UTC",
  "attackEvents": [
    {
      "attackOutcome": "EXPLOITED",
      "attackTypes": "SQL",
      "blocked": false,
      "blockedReason": "",
      "clientAddress": "",
      "clientAddressType": 0,
      "clientPort": "39541",
      "cveId": "00000000-0000-0000-0000-000000000000",
      "detailJson": {
        "name": "Non Parameterized SQL Query detected",
        "sql": "SELECT * FROM users WHERE name = '' OR *=* --'",
        "sqlSignals": {
          "containsComment": true,
          "containsOrTrue": true
        }
      },
      "environment": "lab0",
      "eventType": "SQL_NONPARAM",
      "jvmId": "<string>",
      "keyInfo": "SELECT * FROM users WHERE name = '' OR *=* --'",
      "maliciousIpOut": "",
      "maliciousIpSource": "",
      "maliciousIpSourceOut": "",
      "matchedCveName": "",
      "serverAddress": "<host-ip>",
      "serverName": "Unknown",
      "serverPort": "<host-port>",
      "service": "payment-service",
      "serviceId": "<string>",
      "stackTrace": "<long-string>",
      "timestamp": "2026-08-06T17:14:05.00023Z",
      "vulnerabilityInfo": null,
      "vulnerableMethod": "",
      "webTransactionUrl": "http://localhost:8080/api/v1/users/search"
    }
  ]
}
Notification payload fields

The following table describes the fields in the notification payload.

Important: Payload fields (including businessTransactionName) might contain arbitrary text sourced from your own environment or instrumentation and should be treated as untrusted by whatever consumes the webhook.
Field Type Description
attackName string Attack identifier or name.
attackStatus string Current status of the attack.
attackSource string Indicates whether the attacker is inside or outside your network.
attackOutcome string Result of the attack, in order of increasing severity.
attackTypes string Attack category. See attack type values.
eventTrigger string Specific payload or input that triggered detection, such as a raw SQL query, command, or file path. The value varies by attack type. Internally, this field is called KeyInfo.
environment string Present only in Splunk Observability Cloud mode. This field is renamed from applicationName.
service string Present only in Splunk Observability Cloud mode. This field is renamed from tierName.
businessTransactionName string Business transaction associated with the attack.
lastDetected timestamp Last time the attack was observed.
attackEvents array Individual raw security events that make up the attack. See fields in the attackEvents array.
attackTypes

The following table lists valid values for the attackTypes field.

Value Meaning
RCE Remote code execution.
LFI Local file inclusion (file read from outside the application path).
PATH Path traversal.
SSRF Server-side request forgery.
DESEREAL Untrusted deserialization.
EXPR Expression language injection.
MALIP Malicious IP address (inbound request from a known-bad IP).
EXC Uncaught exception.
SQL Non-parameterized SQL query.
SEN_LOG Sensitive information logged.
VULN Not an attack; indicates that a vulnerability was detected in the application.
API Typically not an attack; indicates an API call observation.
LOG4J Log4j-related attack caused by a socket connection triggered by Log4j.
COMMAND Local code execution detected through the JVM security manager.
attackEvents

Each object in the attackEvents array contains the following fields.

Field Type Description Possible values
attackOutcome string Outcome of this specific event. Same values as top-level attackOutcome.
eventType string Fine-grained event classification. Event-type-specific string, such as SQL_NONPARAM.
attackTypes string Attack type for this event. Same as the top-level attackTypes list. See attack type values.
blocked bool Indicates whether this event was blocked. true or false.
blockedReason string Reason the event was blocked, if applicable. Free-form string, often empty.
clientAddress string Client IP address. IP address or an empty string.
clientAddressType int32 Classification of the client IP address. 0: UNKNOWN; 1: LOOPBACK (127.0.0.0/8); 2: LINKLOCAL (169.254.0.0/16); 3: PRIVATE (RFC 1918); 4: PUBLIC.
clientPort string Client port. Numeric string.
cveId UUID Internal CVE reference ID. Set only for vulnerability-related events. UUID or all-zero UUID.
detailJson object Attack-type-specific structured detail. For example, SQL details can include name, sql, and sqlSignals fields with containsComment and containsOrTrue values. Arbitrary JSON object; shape varies by eventType.
jvmId string JVM instance ID of the affected application node. UUID-like string.
keyInfo string Same content as top-level eventTrigger. Free-form string.
maliciousIpOut string Outbound IP address flagged as malicious. IP address or an empty string.
maliciousIpSource string Threat-list name that matches the inbound malicious IP address. String or an empty string.
maliciousIpSourceOut string Threat-list name that matches the outbound malicious IP address. String or an empty string.
matchedCveName string CVE matched against the stack trace. String or an empty string.
serverAddress string Server IP address that handled the request. IP address.
serverName string Server hostname. String, often Unknown.
serverPort string Server port. Numeric string.
service string Splunk Observability Cloud mode service name, renamed from tierName. String.
serviceId UUID Splunk Observability Cloud mode service or tier ID, renamed from tierId. UUID.
stackTrace string Java stack trace at the detection point, truncated to 256 lines. Multiline string.
timestamp timestamp Time when this specific event occurred. RFC 3339 timestamp.
vulnerabilityInfo object or null Populated only when vulnerableMethod matches a known CVE. null for pure attack events.
vulnerableMethod string Method signature identified as vulnerable. String or an empty string.
webTransactionUrl string URL of the HTTP request tied to the event. URL string.