Cybatar Security Hub · Governance · Risk Management · Threat Resilience · Compliance & Audit
Unified enterprise security operations for modern organisations
Security Hub
Client login Open portal
Cybatar / Connectors / Webhooks
Connector guide

Signed webhook ingestion

Receive custom security events through an authenticated webhook path with explicit controls around origin, signature and payload size.

Published 2026-08-17 Reviewed 2026-08-17
What this page establishes

Cybatar includes a signed webhook ingestion workflow with per-endpoint secrets, optional IP allowlists, payload limits and ingestion-attempt records.

What Cybatar can represent

Administrators can create webhook endpoint records with an endpoint UUID, source type, status and optional allowed IP addresses. Webhook requests are verified using Cybatar timestamp and signature headers against an encrypted shared secret. The receiver enforces a 2 MB payload limit and a 5,000-event batch limit in the current implementation. Accepted requests create ingestion-attempt records including received time, source IP, event count, raw payload and a normalized preview.

What is not claimed

A public unauthenticated webhook endpoint. Unlimited payload size or event volume. Automatic normalization of every arbitrary payload into every Cybatar security record.

Implementation questions

VerifyWhich source will send the webhook and what event schema does it use?
VerifyWill source IP allowlisting be practical for the sender?
VerifyHow will the shared secret be distributed and rotated?
VerifyHow will incoming fields map to Cybatar source IP, destination IP, event type and severity fields?
Webhook ingestion developer guidehttps://cybatar.co/developers/webhook-ingestion SIEM Event Pipelinehttps://cybatar.co/platform/siem-event-pipeline Security Operationshttps://cybatar.co/platform/security-operations

Frequently asked questions

Does Cybatar verify webhook signatures?

Yes. The current receiver verifies timestamped HMAC-signed requests using Cybatar signature headers and the endpoint shared secret.

Can webhook endpoints restrict source IPs?

Yes. The current endpoint model supports an optional list of allowed IP addresses.

What payload limits are enforced?

The current receiver rejects payloads larger than 2 MB and batches containing more than 5,000 events.

Connector claim boundary

Connector availability depends on deployment configuration, credentials, source APIs, data formats and enabled modules. Public connector pages do not claim vendor certification, marketplace approval, complete field coverage, real-time delivery guarantees, universal API support or a successful connection to a third-party service unless that is verified in the specific deployment.