Webhooks

Overview

Acante supports Webhooks to PUSH dynamic events (aka notifications) triggered by Acante’s analytical data processing. The receiving application on the customer side can implement custom workflows to process the events received depending on their use-case and runbooks.

• Types of events to subscribe to: These will be listed in the Acante WebApp configurations page for the user to make a selection
• Webhook URL i.e. endpoint of receiving application (in customer environment): This will be listed in the Acante WebApp configurations page

Acante support two user selectable integration models for Webhooks

Slack Integration

Slack Workflow Automation is increasingly becoming the tool of choice for customers’ security workflows. Acante supports native integration to Slack by posting events to a dedicated Slack channel in the customer’s Slack workspace.

Connect Acante WebApp to your Slack workspace in 2 clicks. It uses Slack’s incoming webhooks as described in https://api.slack.com/messaging/webhooks

Authentication for Slack

Uses OAuth as described in https://api.slack.com/authentication/oauth-v2

Customer Provided Webhook

Customers may want to use a different workflow automation tool than Slack, e.g. pipedream, ifttt or their own custom application .

On the Configuration pages in the Acante UI, add the endpoint webhook URL (e.g. the customer SIEM) to which Acante will send JSON messages using /POST. This is similar to how Github webhooks or Stripe webhooks work. See event payload below for testing requirements.

Authentication for Customer Webhook

Acante supports 2 approaches:

1. When configuring the webhook on the Configuration pages in the Acante UI, add the secret token along with the webhook URL. Acante creates a hash signature using this secret token to include in the header, similar to how Github works: https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
2. Similar to the first approach, but instead of a customer-provided secret token, Acante will generate the API Key on the Configurations page on the AcanteUI.

Event Payload (i.e. POST by Acante)

In order to test the event payload being sent by Acante, if you don’t have a webhook URL ready yet, you can choose a lightweight option like requestbin (see example) or smee (see Github testing example)

Content-Type: application/json

{
  "type":"...",    // Event type subscribed to by the user
  "id":"...",      // Unique identifier for the event generated
  "generated_at":"...", // UTC timestamp at which event was generated
  "details": { // NOTE: The following details pertain ONLY to the event generated
    "description":"...", // Description of the event analysis
    "severity_level":"...", // Critical, High, Medium
    "data_resource_arn":"...",
    "datastore_name":"...",
    "resource_type":"...",
    "datasets":"[ // OPTIONAL
        "dataset_name":"...",
        "fields": [...]
      ]",
    "highest_sensitivity_level_priority":"...", // OPTIONAL
    "data_classes": [...], // OPTIONAL
    "enterprise_users_count":"...", // OPTIONAL
    "roles_count":"...", // OPTIONAL
    "source_identities": [...], // OPTIONAL
    "read_request_count_label":"...", // OPTIONAL: Low, Medium, High
    "write_request_count_label":"...", // OPTIONAL: Low, Medium, High
    "read_volume_label":"...", // OPTIONAL: Low, Medium, High
    "write_volume_label":"...", // OPTIONAL: Low, Medium, High
    "additional_info": {...} // OPTIONAL: Used to provide more context for the event analysis
  }
}

Response Examples

 {
    "type":"drift - data access",
    "id":"0123456789",
    "generated_at":"...",
    "details": {
      "description":"New DB User is accessing sensitive data",
      "severity_level":"High",
      "data_resource_arn":"arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance-1",
      "datastore_name":"ABC",
      "resource_type":"AWS_RDS",
      "datasets": [
        {
          "dataset_name":"XYZ",
        },
      ],
      "highest_sensitivity_level_priority":"P1-Restricted",
      "data_classes": ["PII", "PCI"],
      "roles_count":"1",
      "read_request_count_label":"Low",
      "read_volume_label":"Medium"
    }
  },
  {
    "type":"drift - data access",
    "id":"9876543210",
    "generated_at":"...",
    "details": {
      "description":"Potential exfiltration: User is accessing high volume of sensitive data",
      "severity_level":"Critical",
      "data_resource_arn":"arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance-1",
      "datastore_name":"ABC",
      "resource_type":"AWS_RDS",
      "datasets": [
        {
          "dataset_name":"XYZ",
        },
        {
          "dataset_name":"PQR",
        }
      ],
      "highest_sensitivity_level_priority":"P1-Restricted",
      "data_classes": ["PII", "PCI"],
      "roles_count":"1",
      "source_identities": ["1.1.1.1"],
      "read_request_count_label":"Medium",
      "read_volume_label":"High"
    }
  }

Response Field Descriptions

Response is an array of Events and their details. For each event, following fields are provided:

Types of Events Generated by Acante

Acante analyzes changes in the data, data access patterns, privileges etc. and highlights noteworthy changes in the form of events. These changes could represent drifts, high baselines, potentials threats and so on. They are bucketed using the “type” field in the events API.
Users can subscribe to select event “types”:

Payload Example

• Using customer provided OAuth secret token

curl -i -X POST https://<endpoint-url> \
  -H "Authorization: Bearer <secret-token>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d <TBD>

• Using Acante provided API key

curl -i -X POST https://<endpoint-url> \
  -H "x-api-key: <api-key>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
 -d <TBD>