View webhook batches

A webhook batch record is created for each webhook execution.

Before you begin

Role required: admin

About this task

In order to reduce the number of API calls sent to the webhook endpoints, batching of events is implemented in webhooks. For each webhook, if there are multiple events triggered almost during the same time, then all these events are sent as part of the same request to the webhook endpoint.

Procedure

1. Navigate to All > Threat Intelligence Security Center > Administration.
2. Select Webhooks Configurations > Webhooks.
   The Webhooks page displays.
3. Select the webhook.
4. Go to Error Logs.
5. View the error logs.
   The list view shows all the error logs from one particular webhook.
6. Go to Batch column.
7. Click on any Batch ID.
   The Webhook Batch page is displayed.

   Note:

   All the batches are stored in the table sn_sec_tisc_webhook_batch.

   Below is the sample payload format that the webhook end point receives:

   {
       "batch_id": "06eeb3693b6bca10f6f82a60c5e45a7b",
       "events": [
           {
               "record": "Observable",
               "record_fields": {
                   "is_false_positive": "false",
                   "reputation": "malicious",
                   "sys_updated_on": "2024-07-22T14:31:26.000Z",
                   "type": "url",
                   "sys_updated_by": "admin",
                   "sys_created_on": "2024-07-04T06:45:20.000Z",
                   "id": "url--1e77adb7eb8b06107750fa86cad0cd70",
                   "is_defanged": "false",
                   "sys_created_by": "SecCommon.System",
                   "tags": "Enriched",
                   "taxonomies": "T1: V1",
                   "domain": "urlhaus.abuse.ch",
                   "status": "active",
                   "source_count": "1",
                   "threat_score": "20",
                   "sys_id": "da77adb7eb8b06107750fa86cad0cd70",
                   "value": "https://urlhaus.abuse.ch/url/2578255/",
                   "confidence": "89",
                   "expiration_time": "2025-10-07T07:13:18.000Z",
                   "tlp": "CLEAR"
               },
               "trigger": {
                   "name": "Observable Update",
                   "type": "UPDATE",
                   "trigger_time": "2024-07-22T14:31:26.000Z",
                   "trigger_fields": [
                       {
                           "field_name": "reputation",
                           "previous_value": null,
                           "current_value": "malicious"
                       }
                   ]
               }
           },
           {
               "record": "Observable",
               "record_fields": {
                   "is_false_positive": "false",
                   "reputation": "malicious",
                   "sys_updated_on": "2024-07-22T14:31:19.000Z",
                   "type": "url",
                   "sys_updated_by": "admin",
                   "sys_created_on": "2024-07-04T06:45:20.000Z",
                   "id": "url--9a77adb7eb8b06107750fa86cad0cd6f",
                   "is_defanged": "false",
                   "sys_created_by": "SecCommon.System",
                   "tags": "Enriched",
                   "taxonomies": "T1: V1",
                   "domain": "urlhaus.abuse.ch",
                   "status": "active",
                   "source_count": "1",
                   "threat_score": "20",
                   "sys_id": "5a77adb7eb8b06107750fa86cad0cd6f",
                   "value": "https://urlhaus.abuse.ch/url/2578264/",
                   "confidence": "89",
                   "expiration_time": "2025-10-07T07:13:18.000Z",
                   "tlp": "CLEAR"
               },
               "trigger": {
                   "name": "Observable Update",
                   "type": "UPDATE",
                   "trigger_time": "2024-07-22T14:31:19.000Z",
                   "trigger_fields": [
                       {
                           "field_name": "reputation",
                           "previous_value": null,
                           "current_value": "malicious"
                       }
                   ]
               }
           }
       ]
   }

   Following table lists the batch payload structure and its attributes which will be sent to the users as webhook payload:

   Parameters in Batch Payload	Type	Description
   batch_id	String	Specifies unique identifier for a batch.
   events	Array of Objects	Contains an array of events which are triggered as part of that webhook. Each event will contain the snapshot of the field values at the time of event generation and also contains the trigger information. Note: For more information on viewing the parameters in the event object, see Webhook Triggers.

   Note:
8. Click Retry batch button to retry the failed batch.
   Note:

   You can also trigger the retry batch for the completed batches.