# Sending Alerts via IPv4 Webhooks

**URL:** <https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913>\
**Category:** Signals Alerting\
**Created:** [August 5, 2020, 3:01am UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913 "2020-08-05T03:01:22Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![H1L021](https://avatars.discourse-cdn.com/v4/letter/h/ee59a6/32.png) [@H1L021](https://forum.search-guard.com/u/H1L021)\
**Post date:** [August 5, 2020, 3:01am UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/1 "2020-08-05T03:01:22Z")

</div>

Hello there,

I am new to SearchGuard. I already tried opendistro and I found a problem about webhooks not supporting IPv4 in order to send alerts to an internal instance of TheHive.

Does SearchGuard has de same issue ? anyone tried it before ?

Thank you

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [August 5, 2020, 11:25am UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/2 "2020-08-05T11:25:45Z")

</div>

Hi  
The last time I checked the webhook action in the SearchGuard Signals app, it worked. Here is the doc [Webhook Actions | Alerting for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/elasticsearch-alerting-actions-webhook)

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [August 5, 2020, 11:26am UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/3 "2020-08-05T11:26:41Z")

</div>

There is no issue with IPv4.

---

<div class="post-metadata">

**Author:** ![H1L021](https://avatars.discourse-cdn.com/v4/letter/h/ee59a6/32.png) [@H1L021](https://forum.search-guard.com/u/H1L021)\
**Post date:** [August 14, 2020, 3:43pm UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/4 "2020-08-14T15:43:31Z")

</div>

I finally got my hands around signals creation. After many errors I got my alert logic to give me back some result now i am stuck the the action part of my webhook to Thehive.

This is the error I get :

```
{
  "tenant": "_main",
  "watch_id": "mywatch",
  "status": {
    "code": "ACTION_FAILED",
    "detail": "All actions failed"
  },
  "execution_start": "2020-08-14T15:38:43.514Z",
  "execution_end": "2020-08-14T15:38:43.606Z",
  "actions": [
    {
      "name": "my_webhook_action",
      "status": {
        "code": "ACTION_FAILED",
        "detail": "Web hook returned error: HTTP/1.1 400 Bad Request\n\n{\"type\":\"AttributeCheckingError\",\"message\":\"[Attribute type is missing][Attribute source is missing][Attribute sourceRef is missing][Attribute title is missing][Attribute description is missing]\",\"errors\":[{\"name\":\"type\",\"type\":\"MissingAttributeError\"},{\"name\":\"source\",\"type\":\"MissingAttributeError\"},{\"name\":\"sourceRef\",\"type\":\"MissingAttributeError\"},{\"name\":\"title\",\"type\":\"MissingAttributeError\"},{\"name\":\"description\",\"type\":\"MissingAttributeError\"}]}"
      },
      "error": {
        "message": "Web hook returned error: HTTP/1.1 400 Bad Request\n\n{\"type\":\"AttributeCheckingError\",\"message\":\"[Attribute type is missing][Attribute source is missing][Attribute sourceRef is missing][Attribute title is missing][Attribute description is missing]\",\"errors\":[{\"name\":\"type\",\"type\":\"MissingAttributeError\"},{\"name\":\"source\",\"type\":\"MissingAttributeError\"},{\"name\":\"sourceRef\",\"type\":\"MissingAttributeError\"},{\"name\":\"title\",\"type\":\"MissingAttributeError\"},{\"name\":\"description\",\"type\":\"MissingAttributeError\"}]}"
      },
      "execution_start": "2020-08-14T15:38:43.524Z",
      "execution_end": "2020-08-14T15:38:43.599Z"
    }
  ],
  "node": "elk-sg",
  "_id": "vsaf7XMB7DSIF7OVjucZ",
  "_index": ".signals_log_2020.08.14"
}

```

This is my action :

```
"actions": [{
    "type": "webhook",
    "name": "my_webhook_action",
    "request": {
      "url": "http://192.168.20.220:9000/api/alert",
      "method": "POST",
      "body": "{\"text\": \"Powershell Process was created {{data.PowershellProcessCreation.hits.hits.length}} time over the last {{data.myconstants.window}}\"}\n",
      "headers": {
					"Content-Type": "application/json",
					"Authorization": "Bearer 3H9GBe6Xxkz+55wilOMn0TZZReMCPBW5"
			}
    }
  }]

```

Thank you

---

<div class="post-metadata">

**Author:** ![H1L021](https://avatars.discourse-cdn.com/v4/letter/h/ee59a6/32.png) [@H1L021](https://forum.search-guard.com/u/H1L021)\
**Post date:** [August 14, 2020, 3:44pm UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/5 "2020-08-14T15:44:37Z")

</div>

the search on the watch gives me matches on process creation :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/70f35d5e9aadc4e6c50d384180a1d63be213e087.png)

But the action is the only point of my failure at this point

---

<div class="post-metadata">

**Author:** ![H1L021](https://avatars.discourse-cdn.com/v4/letter/h/ee59a6/32.png) [@H1L021](https://forum.search-guard.com/u/H1L021)\
**Post date:** [August 14, 2020, 3:51pm UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/6 "2020-08-14T15:51:47Z")

</div>

> [@H1L021](#):
>
> `{\"type\":\"AttributeCheckingError\",\"message\":\"[Attribute type is missing][Attribute source is missing][Attribute sourceRef is missing][Attribute title is missing][Attribute description is missing]\",\"errors\":[{\"name\":\"type\",\"type\":\"MissingAttributeError\"}`

These are required by TheHive I just figured out this. Sorry!

---

<div class="post-metadata">

**Author:** ![H1L021](https://avatars.discourse-cdn.com/v4/letter/h/ee59a6/32.png) [@H1L021](https://forum.search-guard.com/u/H1L021)\
**Post date:** [August 14, 2020, 4:20pm UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/7 "2020-08-14T16:20:56Z")

</div>

Im gonna leave this for anyone like me new to this trying to figure out how to send alerts from SearchGuard to th TheHive :

```
"actions": [{
    "type": "webhook",
    "name": "my_webhook_action",
    "request": {
      "url": "http://<THEHIVE_IP>:9000/api/alert",
      "method": "POST",
      "body": "{\"title\": \"Title Example\",\n \"description\": \"Descritpion Example\",\n \"type\": \"external\",\n \"source\": \"sourceexample\",\n \"sourceRef\": \"searchguard-signal\"}\n",
      "headers": {
					"Content-Type": "application/json",
					"Authorization": "Bearer <YOUR API KEY>"
			}
    }
  }]

```

 ![image](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/dad312339f2971e250c92f20edb98803d5137f5a.png)

thank you!

---

<div class="post-metadata">

**Author:** ![H1L021](https://avatars.discourse-cdn.com/v4/letter/h/ee59a6/32.png) [@H1L021](https://forum.search-guard.com/u/H1L021)\
**Post date:** [August 15, 2020, 5:34pm UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/8 "2020-08-15T17:34:49Z")

</div>

One thing to take note of is that TheHive creates an internal alert ID from an MD5 hash value of {type, source, sourceRef}. so one of them should be unique in order to keep generating an alert everytime something is detected.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [August 17, 2020, 8:41am UTC](https://forum.search-guard.com/t/sending-alerts-via-ipv4-webhooks/1913/9 "2020-08-17T08:41:57Z")

</div>

@H1L021 thank you for the feedback.