Webhooks

Get a signed POST on every block and behavioral anomaly. One webhook integrates Kaizen with Slack, PagerDuty, your SIEM, or anything custom.

Add a webhook

In the console, open Webhooks, add your endpoint URL, and save the signing secret (it is shown once). Paste a Slack incoming webhook and Kaizen formats messages for Slack automatically.

Bring your own key

Destinations that authenticate with a key in a header (Datadog, Splunk HEC, a custom SIEM) take your own credential. In the console, expand Add an auth header, set the header name (for example DD-API-KEY) and your key. Kaizen stores it encrypted at rest and attaches it only at delivery time. Kaizen never holds a shared key for your tools.

Payload

{
  "event": "anomaly",
  "data": {
    "agent": "support-bot",
    "reason": "this agent did a kind of action it has never done (connect), a tool it has never used (export_file)...",
    "action": { "kind": "connect", "tool": "export_file", "target": "45.9.148.108" }
  }
}

Events delivered: verdict.block and anomaly.

Verify the signature

Every request carries X-Kaizen-Signature: sha256=<hex>, an HMAC-SHA256 of the raw request body keyed with your signing secret.

import hmac, hashlib

def verify(body: bytes, signature_header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

PagerDuty

Add your PagerDuty Events API v2 URL (https://events.pagerduty.com/v2/enqueue) as the webhook URL and put your routing key in the credential value. Kaizen detects PagerDuty automatically and sends a correctly-shaped trigger event (severity error for a block, warning for an anomaly).

Also available

Slack, Microsoft Sentinel, and OpenTelemetry.