Cybatar Security Hub · Governance · Risk Management · Threat Resilience · Compliance & Audit
Unified enterprise security operations for modern organisations
Security Hub
Client login Open portal
Cybatar / Developers / Webhook ingestion
Developer guide

Webhook ingestion

Cybatar contains a concrete webhook-ingestion path for external security tooling. This guide documents the controls visible in the current implementation without publishing deployment secrets or implying that the receiver is anonymous or unrestricted.

Published 2026-08-17Reviewed 2026-08-17

Implementation facts

Webhook endpoints use a generated UUID and shared secret. The plaintext secret is shown when issued; the stored credential is encrypted with a separate preview value. Requests can be restricted by configured source IP addresses. Requests require X-Cybatar-Timestamp and X-Cybatar-Signature headers and are HMAC verified. Current limits are 2 MB per request and 5,000 events per batch. Accepted requests create ingestion-attempt records containing source IP, event count, raw payload and normalized preview data.

Recommended implementation workflow

STEP 1

Create and activate a webhook endpoint inside the authenticated Cybatar administration workflow.

STEP 2

Store the issued signing secret in the sending system; do not rely on the preview as a credential.

STEP 3

Optionally restrict the endpoint to known source IP addresses.

STEP 4

Serialize the outbound event payload and sign it using the deployment’s Cybatar webhook signing procedure.

STEP 5

Send the timestamp and signature headers with the request and keep payloads within the current size and batch limits.

STEP 6

Monitor ingestion-attempt records and source health after rollout.

Security and claim boundary

The exact endpoint UUID, secret and deployment-specific signing material are private. This public guide intentionally does not expose live endpoint values or claim compatibility with every webhook sender.

Frequently asked questions

Is Cybatar webhook ingestion authenticated?

Yes. The current implementation requires a valid timestamped HMAC signature and can additionally restrict source IPs.

Are webhook credentials stored in plaintext?

The endpoint creation workflow stores an encrypted shared secret and a separate preview value; the issued plaintext secret is intended to be copied at creation time.

Does the receiver accept unlimited event batches?

No. The current receiver enforces both request-size and event-count limits.