Ransomware Defender & Easy Auditor Webhooks (Zero Trust)

This feature integrates Ransomware Defender/Easy Auditor alerts with real-time webhooks, with customizable payload data for SIEM and security-automation consumption.

Configure Zero Trust Webhook Alarm Forwarding

note

Requires Eyeglass and Ransomware Defender 2.5.12 or later.

1. In Ransomware Defender, open the Zero Trust menu and click + to add a webhook target.
2. Configure:
   • Name — a label for the endpoint (e.g. "Splunk")
   • URL — the endpoint that receives POST messages (from your SIEM/security vendor)
   • Event Severity Filter — one or more severities to forward
   • Lifecycle Filter — one or more event lifecycle stages (from initial detection through acknowledgment/clearing) to forward; downstream automation can react differently per stage
   • Headers — optional key/value pairs for authentication or custom headers
3. Click Save, then use the test webhooks button to send a sample payload and confirm the endpoint accepts it.

Viewing the Webhook Payload

1. Requires direct or proxied internet access to https://webhook.site/ over HTTPS.
2. Open https://webhook.site/, copy the generated test URL.
3. Paste it into a test webhook endpoint in Ransomware Defender and click test webhooks — confirm the POST arrives on the webhook.site page.
4. Trigger Security Guard to see a full real payload, which includes user, snapshot, share, and affected-file detail.

Example: ServiceNow Incident Integration

A basic example showing how a Zero Trust webhook payload can create a ServiceNow incident. This requires customization to map payload fields to your ServiceNow instance's fields — see ServiceNow's own guide on integrating webhooks to create a Scripted REST Resource.

Sample script (paste into the ServiceNow Scripted REST resource):

(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
  var requestBodystring = request.body.dataString;
  var requestBodyjson = JSON.parse(requestBodystring);
  var incident = new GlideRecord('incident');
  incident.initialize();

  var affectedUser = requestBodyjson.userName;
  var eventState = requestBodyjson.state;
  var affectedCluster = requestBodyjson.nes.join(", ");
  var shareNames = requestBodyjson.shares.map(function(s) { return s.name; });
  var shareNamesString = shareNames.join(", ");

  incident.short_description = 'Superna Ransomware Defender Alert - Affected User ' + affectedUser +
    ', Affected Clusters ' + affectedCluster + ', Affected SMB Shares ' + shareNamesString +
    ', Event state ' + eventState;
  incident.description = requestBodystring;
  incident.caller_id = 'john.doe';
  incident.category = 'Software';
  incident.subcategory = 'Superna Ransomware Defender';

  var severity = requestBodyjson.severity;
  if (severity == "CRITICAL") { incident.impact = 1; incident.urgency = 1; }
  if (severity == "MAJOR") { incident.impact = 2; incident.urgency = 2; }
  if (severity == "MONITOR") { incident.impact = 2; incident.urgency = 2; }
  if (severity == "WARNING") { incident.impact = 3; incident.urgency = 3; }

  var sysId = incident.insert();
  if (sysId) {
    response.setStatus(201);
    response.setBody({ 'sys_id': sysId, 'number': incident.number });
  } else {
    response.setStatus(500);
    response.setBody({ 'error': 'Failed to create incident.' });
  }
})(request, response);

Steps to wire it up:

1. Save the Scripted REST resource after pasting the script.
2. Disable security on the resource for initial testing.
3. Copy the resource's endpoint URL (https://<your-instance>.service-now.com/<resource_path>).
4. In Ransomware Defender's Zero Trust webhook config, set this as the target URL and add a Content-Type: application/json header.
5. Save and click the test button — a successful call returns an incident number.

note

This is a starter example — field mapping should be customized to match your ServiceNow instance's incident fields and workflow.

See Also

For alarm forwarding over syslog, or Postfix-based custom email/webhook routing, see Alarm Forwarding (Syslog) and Custom Email/Webhook Routing.