A multi-endpoint webhook manager that receives, stores, and audits inbound security events, with delivery history, payload inspection, and replay for dropped or failed deliveries.
The Problem
Security platforms integrate with dozens of tools via webhooks: SIEMs, EDRs, threat intel feeds, ticketing systems, and client notification services. Every one of those integrations is a fire-and-forget pipe with no audit trail.
When an alert webhook fails, no one knows. When a SOAR integration drops an event during maintenance, the alert is gone. When a compliance audit asks "did you receive this notification?", the answer is usually a spreadsheet guess.
Silent event loss in webhook pipelines is a documented gap in MDR operations. You cannot replay what you never stored.
The Solution
A webhook endpoint manager that treats every inbound request as a first-class record. Webhooks are received, stored in full (payload, headers, status, timing), and held for inspection or replay. Each endpoint has a unique URL and HMAC secret for validation. Deliveries can be replayed to a configured forward URL when downstream processing fails.
Key Features:
- Auto-generated unique webhook URLs with HMAC signing secrets per endpoint
- Per-endpoint enable/disable toggle (disabled endpoints still log, but return 200 without forwarding)
- Every inbound request stored before processing: payload, headers, response, duration
- Success rate tracking per endpoint for integration health monitoring
- Delivery history per endpoint with full payload and header inspection
- Replay: re-POST any stored delivery to the endpoint's configured forward URL
- Log deletion with confirmation for housekeeping and compliance scope management
- JSON/Raw toggle on payload viewer for structured and unstructured event inspection
Use Cases
MDR / SOC-as-a-Service platforms: Ingest alerts from client EDR and SIEM tools via dedicated per-client webhook endpoints. Every alert is stored before it touches the triage pipeline. Dropped alerts during SOAR downtime can be replayed in order once the integration recovers.
MSSP operators: Route client notification events (incidents, policy violations, patch failures) through named webhook endpoints. Audit trail satisfies client SLA reporting without manual logging.
GRC compliance tools: Receive compliance events from cloud posture tools, identity providers, and audit systems. Full delivery log with timestamps satisfies SOC 2 CC7.2 and ISO 27001 A.12.4 logging requirements with no additional tooling.
Offensive Security / Red Team platforms: Receive callback notifications from out-of-band payloads and exfiltration probes. Replay functionality lets operators re-examine captured payloads during post-engagement review.
Impact
- Silent alert loss eliminated: every inbound event is persisted before any processing occurs
- Integration health visible at a glance: per-endpoint success rate with delivery counts
- Replay capability reduces mean time to recovery when downstream systems drop events
- Full audit trail of received events satisfies external audit requirements out of the box
Built by Kunsh Tanwar | ETXcyberops | [email protected]
