riposte-marketplace/integrations/webhook-relay/manifest.yaml

id: webhook_relay
name: Webhook Relay
version: 1.1.0
description: "Reads the alerts that vendors pushed to riposte-relay, the public mailbox for alert webhooks (riposte/relay/). Riposte accepts no inbound connection, so a source whose only output is a webhook — Rapid7 InsightIDR Essential basic detection rules, for one — posts to the relay, and an alert rule on this integration reads one relay source back over outbound HTTPS. The relay knows no vendor: the rule chooses the client, the alert type and the mapper. A read consumes nothing; the rule's watermark is the read's `since`, so after a failover the standby reads the same mailbox from its own watermark."
changelog: "1.1.0 — New fetch_rapid7_alerts command, with its own mapper and a Rapid7 InsightIDR Basic Rule alert type, written from a real InsightIDR Essential delivery. A basic rule posts its alert as a JSON string in a single `payload` field; the command opens it (as a JSON body or a form body) and returns one flat item per message: rule name, correlation id, event time, log set, log, host name and log line. The correlation id is the dedup key, so a redelivery of one firing makes no second alert. The payload carries no severity, user or address: those are in the log line, which the rule may withhold — the alert then says so. | 1.0.1 — The generic mapper fills the OCSF fields that have a place for a relayed message: metadata.logged_time (receipt), metadata.log_provider and log_name (relay, source), metadata.labels (the checks passed, relay:hmac…), raw_data (the payload). The sender address goes to unmapped.relay.sender_ip, not src_endpoint.ip: it is the vendor's cloud, and as an entity it would tie every alert of that vendor together. metadata.product.name no longer holds the source id. | 1.0.0 — Initial release: fetch_messages (ingestion: one alert per relayed message, `since` watermark, page walk), relay_status, test_connection, and a generic mapper that keeps the raw body and the checks the message passed."
category: ingestion

config_schema:
  properties:
    base_url:
      type: string
      description: "The relay's public address, e.g. https://hermod.acknowledge.tools"
    read_token:
      type: string
      description: "The relay's consumer token. The relay holds only its SHA-256 (RELAY_CONSUMER_TOKEN_SHA256); this Riposte must also call from an address in RELAY_CONSUMER_ALLOW_IPS."
      x-soar-sensitive: true
  required:
    - base_url
    - read_token

commands:
  - id: fetch_messages
    name: webhook-relay-fetch-messages
    description: "Messages a relay source received since a watermark, oldest first, every page followed. Ingestion: results path = messages, one alert per message, dedup on the relay's message id. Each message carries source, received_at, remote_ip, headers, verified (the checks it passed: path_token, header_token, hmac, ip), body (or body_b64) and json when the body parses. Reading consumes nothing."
    risk: read
    inputs_schema:
      properties:
        source:
          type: string
          description: "Relay source id, e.g. r7-acme — the mailbox to read. The client this alert rule is bound to must be the one this source was made for."
        since:
          type: string
          description: "Lower bound on received_at: ISO-8601, UNIX seconds or milliseconds. Incremental fetch watermark."
        limit:
          type: number
          description: "Most messages one run may gather (default 10000, the relay's own per-source cap). A window holding more fails the run rather than dropping the rest: the watermark stays put and the next run reads it again."
      required: [source]
    outputs_schema: { properties: {} }
    ingest:
      results_path: messages
      dedup_key: id
      incremental_field: since

  - id: fetch_rapid7_alerts
    name: webhook-relay-fetch-rapid7-alerts
    description: "fetch_messages for a source fed by Rapid7 InsightIDR Essential basic detection rules (notification Webhook). Each message's `payload` — the alert as a JSON string — is opened into one flat item: alert_id (Rapid7's correlation_id, the dedup key), rule, event_time, log_set (Rapid7's host.name), log_name, hostname, log_line and log_event (when the line is JSON), log_line_withheld, plus the relay's id, source, received_at, remote_ip, verified and body. A message that does not decode still yields an item, with decode_error and alert_id relay:<message id>. Results path = alerts."
    risk: read
    inputs_schema:
      properties:
        source:
          type: string
          description: "Relay source id fed by the Rapid7 rule, e.g. r7-acme."
        since:
          type: string
          description: "Lower bound on received_at: ISO-8601, UNIX seconds or milliseconds. Incremental fetch watermark."
        limit:
          type: number
          description: "Most messages one run may gather (default 10000). A window holding more fails the run rather than dropping the rest."
      required: [source]
    outputs_schema: { properties: {} }
    ingest:
      results_path: alerts
      dedup_key: alert_id
      incremental_field: since

  - id: relay_status
    name: webhook-relay-status
    description: "Per relay source: messages waiting, oldest and newest, accepted and rejected counts by reason (ip, path_token, header_token, hmac, size, rate, full…), last accepted, last read. Counters restart with the relay. A rising rejected count on a source is a misconfigured vendor — or someone trying."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: webhook-relay-test-connection
    description: "Verify the relay answers this Riposte and the read token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }