6.0.10 -> 6.1.2 changed webhook behaviour about opencti

[Kedae]

Hi @dominictory,

We indeed change the notification message as it was rather unusable within the platform.
Previously you only add the entity type and the name of the entity in the notification even in case of Description modification for example.

For your case you can do:

{
    "type": "message",
    "attachments": [
            {
                "contentType": "application/json",
                "content": {
                    "alertSubject": "<%=data[0].instance.name%>",
	            "alertOperation": "<%=content[0].events[0].operation%>",
                    "alertDescription": "<%=data[0].instance.description%>",
                    "alertPlatformUrl": "https://10.254.202.12/dashboard/id/<%=content[0].events[0].instance_id%>"
                }
            }
        ]
}

It produces:

{
  "type": "message",
  "attachments": [
    {
      "contentType": "application/json",
      "content": {
        "alertSubject": "Test for webhook",
        "alertOperation": "create",
        "alertDescription": "",
        "alertPlatformUrl": "https://octi/dashboard/id/report--7cd8e1ac-d272-544b-aecb-57dfa8653462"
      }
    }
  ]
}

This will work for any SDO, if you want relationships or observables you will have to use a different attribute from your instance based on what you want to display.

In addition, and as part of our future milestones, we will improve the documentation on this part.

[Kedae]

Within the data[0].instance you should have access to any piece of information regarding your current entity. You can use
<%-JSON.stringify(data[0].instance)%> to display all the information you can access

[dominictory]

Hi @dominictory,

We indeed change the notification message as it was rather unusable within the platform. Previously you only add the entity type and the name of the entity in the notification even in case of Description modification for example.

For your case you can do:

{
    "type": "message",
    "attachments": [
            {
                "contentType": "application/json",
                "content": {
                    "alertSubject": "<%=data[0].instance.name%>",
	            "alertOperation": "<%=content[0].events[0].operation%>",
                    "alertDescription": "<%=data[0].instance.description%>",
                    "alertPlatformUrl": "https://10.254.202.12/dashboard/id/<%=content[0].events[0].instance_id%>"
                }
            }
        ]
}

It produces:

{
  "type": "message",
  "attachments": [
    {
      "contentType": "application/json",
      "content": {
        "alertSubject": "Test for webhook",
        "alertOperation": "create",
        "alertDescription": "",
        "alertPlatformUrl": "https://octi/dashboard/id/report--7cd8e1ac-d272-544b-aecb-57dfa8653462"
      }
    }
  ]
}

This will work for any SDO, if you want relationships or observables you will have to use a different attribute from your instance based on what you want to display.

In addition, and as part of our future milestones, we will improve the documentation on this part.

Thanks Kedae! One final piece for me is including external references in the alert, how would I display this?