Webhook

The Webhook integration pushes Nozomi Networks data, such as nodes, asset information, asset CVEs, or alerts, to any HTTP or HTTPS endpoint that accepts POST requests.

The Webhook integration is the most flexible outbound integration and can connect to custom platforms, middleware, or serverless functions.

Limitations

Only one entity type can be selected per integration instance; create multiple instances for multiple entity types
Authentication supports Bearer token or Basic authentication
Batch size is 50 records per request
The integration receives no data from the endpoint

Data flow

Attribute	Value
Transport	hypertext transfer protocol secure (HTTPS) or hypertext transfer protocol (HTTP) POST
Authentication	Bearer token or Basic authentication
Format	JavaScript Object Notation (JSON), comma-separated value (CSV), or newline delimited JSON (NDJSON)
Batch size	50 records per HTTP POST
Retry	Cursor is not advanced on failure; records are retried on the next run

Entities exchanged

Entity	Definition	Trigger	Create versus update
Alert	A security or operational alert.	Incremental by `record_created_at`	New records only; by `record_updated_at` if `send_updates` is enabled.
Node	A network node, such as an operational technology (OT) or information technology (IT) device.	Incremental by `time`	New records only; daily deduplication if `send_updates` is enabled.
Asset information	Asset information discovered by Nozomi Networks.	Incremental by `time`	New records only; daily deduplication if `send_updates` is enabled.
Asset CVE	A CVE finding associated with an asset.	Incremental by `time`	New records only.

Entity attribute mapping

Fields sent are the raw appliance query result columns for the selected entity. No field renaming is applied. The JSON keys match the appliance column names.

Common alert fields when entity is alerts:

Nozomi field	JSON key	Type	Example
`id`	`id`	string	`550e8400-...`
`time`	`time`	integer	`1729409051000`
`type_id`	`type_id`	string	`VI:NEW-FUNC-CODE`
`name`	`name`	string	`New Function Code`
`description`	`description`	string	`New SCADA function code detected`
`risk`	`risk`	float	`3.5`
`ip_src`	`ip_src`	string	`192.168.1.1`
`ip_dst`	`ip_dst`	string	`192.168.1.2`
`is_security`	`is_security`	boolean	`true`
`appliance_host`	`appliance_host`	string	`guardian-01`

Common node fields when entity is nodes:

Nozomi field	JSON key	Type	Example
`id`	`id`	string	`<uuid>`
`ip`	`ip`	array	`["192.168.1.1"]`
`mac_address`	`mac_address`	string	`00:09:0f:6d:f1:c1`
`label`	`label`	string	`plc-01`
`vendor`	`vendor`	string	`Siemens`
`os`	`os`	string	`SIMATIC S7`

Examples

Outbound payload in JSON format for alerts:

[
  {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "time": 1729409051000,
    "type_id": "VI:NEW-FUNC-CODE",
    "name": "New Function Code",
    "description": "New SCADA function code detected on PLC",
    "risk": 3.5,
    "ip_src": "192.168.1.1",
    "ip_dst": "192.168.1.2",
    "is_security": false,
    "appliance_host": "guardian-01"
  }
]

Outbound payload in CSV format for nodes:

id,ip,mac_address,label,vendor
550e8400-...,192.168.1.1,00:09:0f:6d:f1:c1,plc-01,Siemens

Outbound payload in NDJSON format for nodes:

{"id":"550e8400-...","ip":["192.168.1.1"],"mac_address":"00:09:0f:6d:f1:c1","label":"plc-01","vendor":"Siemens"}
{"id":"550e8401-...","ip":["192.168.1.2"],"mac_address":"00:09:0f:6d:f1:c2","label":"hmi-01","vendor":"Siemens"}

Verification

Check the receiving endpoint's access log for POST requests from the appliance internet protocol (IP) address
In the user interface (UI), check the run history for webhook and verify the sent counts.
Use a service such as webhook.site to capture and inspect raw payloads during testing.