Set up notifications

Set up notifications first so that Secure Application can notify your team as soon as instrumented applications start reporting vulnerabilities or attacks.

Notifications allow third-party platforms to ingest information through webhooks. Currently, Secure Application only supports HTTP-based notifications.

Create a rule to send a notification:

  1. Select Application Security > Notifications > Create notification rule.

  2. Specify settings for the new rule:

    • Rule type: Select Vulnerability or Attack.

    • Rule name: Name of the rule.

    • URL: Endpoint to deliver the notification to.

    • Bearer token:

      To send notifications to Splunk Cloud or Splunk Platform

      1. Generate an HTTP Event Collector (HEC) token that allows access to your account. To learn more, see Set up and use HTTP Event Collector in Splunk Web.

      2. Paste the HEC token you generated into the Bearer token field. Example: Splunk hec-token.

      To send notifications to other platforms

      Enter the Authorization: Bearer header value (token) for your webhook URL auth.

    • Environment: List of allowed environments as a filter. Optional.
    • Service: List of allowed services as a filter. Optional.
  3. Select Activate.

For details on the JSON payload of a notification see How notifications work.