SIEM

Stream signed receipts to your SIEM without rolling a custom webhook adapter. Asqav ships native output formatters for Splunk HEC and Datadog Logs on top of the existing webhook delivery path. Available on all plans, including Free.

How dispatch works

The webhook dispatcher inspects the target URL on every send. URLs containing splunk, hec., datadoghq.com, or logs-api auto-route to the matching SIEM formatter. Any other URL receives the standard JSON alert payload, signed with the same HMAC scheme. Slack, Discord, and Teams URLs continue to use their existing chat formatters.

Splunk HEC

Splunk HTTP Event Collector receives an envelope with time, host, source, sourcetype, and the original alert payload under event.

Webhook target shape:

url: your Splunk HEC endpoint (e.g. https://splunk.example.com:8088/services/collector). The host or path must contain splunk or hec. for auto-detection.
events: list of alert event types, or ["*"] for all.
HEC token: send as the standard Authorization: Splunk <token> header on the receiver side. Asqav signs the body with the webhook secret in X-Asqav-Signature.

Datadog Logs

Datadog receives a Logs API entry with ddsource: asqav, severity-mapped status, alert message, and the original payload under asqav. Tags include alert_type, severity, and agent_id when present.

Webhook target shape:

url: https://http-intake.logs.datadoghq.com/api/v2/logs (or your Datadog region equivalent). Must contain datadoghq.com or logs-api.
events: list of alert event types.
Datadog API key: include as a query parameter on the URL or as a header recognised by your receiver. Asqav adds X-Asqav-Signature and X-Asqav-Timestamp alongside whatever credentials you set.

Configure a webhook

Use the standard webhook endpoint. The SIEM format is selected from the URL automatically. The response includes the secret once. Store it where you store webhook signing secrets.

bash

curl -X POST https://api.asqav.com/api/v1/webhooks \
  -H "X-API-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://splunk.example.com:8088/services/collector",
    "events": ["*"]
  }'

Verify deliveries with the standard X-Asqav-Signature HMAC-SHA256 header (signed over timestamp.body). See Webhooks for the full signature scheme and retry semantics.