Send Alerts via Webhook (API call) to AirMDR

✨ Step-by-Step for End Users

Go to AirMDR Admin console.
Use your credentials to SignIn.

Create Alerts on AirMDR

Create the API key.
Refer to 🔗 How to generate an AirMDR API Token
To create alert on AirMDR services use the following API request Fill in:
- API URL: Create alerts
- Method: POST
- 🔐Authentication (AirMDR API Key).
  Header = {"Cookie": "Session="API_KEY", "Content-Type": "application/json"}
Choose what types of alerts you want sent automatically (e.g., all, critical only, specific policies).

Payload Format and Mandatory Params

Define the payload format (default is JSON).

Test the webhook feature to make sure it’s working

📦 Request Body Parameters for creating alerts:

Field	Type	Required	Description
`alert_content`	string	✅	The content/body of the alert
`alert_provider`	string	✅	The provider/source of the alert (e.g. cyberhaven, aws, microsoft_graph, etc.)
`Organization_code`	string	✅	Code/identifier of the organization this alert belongs to
`alert_type`	string	✅	The type/category of the alert
`created_at_source`	integer <int64>	❌	Timestamp when the alert was created at the source/provider

AirMDR Json parameters

 {
   "alert_content": "string",
   "alert_provider": "string",
   "alert_type": "string",
   "organization_code": "string",
   "created_at_source": integer <int64>
 }

Mandatory Required Params:

“organization_code”: “string”,
To fetch your organization code on AirMDR services use the following API request
- API URL: getOrganizationsAPI
- Method: GET
- 🔐Authentication (AirMDR API Key).
  Header = {"Cookie": "Session="API_KEY", "Content-Type": "application/json"}
“alert_content”: “string”,
“alert_provider”: “string”
To fetch list of providers on AirMDR services use the following API request
- API URL: getProvidersAPI
- Method: GET
- 🔐Authentication (AirMDR API Key).
  Header = {"Cookie": "Session="API_KEY", "Content-Type": "application/json"}
“alert_type”: “string”
In order for the AI to automatically investigate an alert, the user must provide the alert_type parameter.

📋 Quick Example: Sending Alert to AirMDR via Webhook

Request sample

curl --location 'https://app.airmdr.com/airmdrapi/alerts' \
--header 'Cookie: Session="<your API KEY>"' \
--header 'Content-Type: application/json' \
--data '{
    "alert_content": "Dummy content",
    "alert_provider": "aws",
    "organization_code": "ASO",
    "alert_type": "Dummy Alert Type",
    "created_at_source": 1717659339
}'

Response sample

{
"alert_content":"Dummy content",
"alert_id":"ASO-AWS-129",
"alert_provider":"aws",
"alert_type":"Dummy Alert Type",
"alert_uuid":"7ffe9065-ef7e-44ee-b19f-142de5e10422",
"created_at":1746425005,
"created_at_source":1746425005,
"created_by":"11f9cc8f-8c0c-484d-a2e7-de2b5b9b05ea",
"investigation_retry_count":0,
"investigation_status":0,
"modified_at":1746425005,
"organization_code":"ASO",
"organization_uuid":"accb34f3-85c5-4137-906b-55b3022034a3"
}

Investigation Status Values:Created = 0,
Submitted = 5,
InProgress = 10,
Completed = 15,
Failed = 20

AirMDR Alerts Dashboard UI

You can view all your created alerts on the Alerts page.

If the User provides the alert_type parameter, AI automatically

Creates a new Investigator Playbook (If there is no existing playbook for specified alert_type)
or
Investigate the alert within the existing Investigator Playbook and
Creates a Case (Everytime a new Case is generated in the Case Management).

The alert content is organized and segregated in the Alerts page, with each column indicating the corresponding data.

Title	Description	Example
ID	The ID is compiled as Org ID-Alert provider-Sequence Number	ASO-AWS-129
ORG	Organization Identifier: Unique code assigned to respective organization	ASO
PROVIDER	Alert provider refers to the system, service, or tool that generated or sent the alert which triggered the playbook.	aws
ALERT NAME	Alert Name/Alert Type is a descriptive title or identifier of the alert that triggered the workflow.	Dummy Alert Type
STATUS	Common Alert Status Values in a Playbook	`Created` `Submitted` `Inprogress` `Completed` `Failed`
CREATION TIME	The timestamp indicating when the alert was first generated or ingested into the system.	May 05 2025, 11:33 AM
INVESTIGATOR	Automated Playbook workflow created on AirMDR services	ASO aws - Dummy Alert Type - AI Generated May 05, 2025
CASE ID	Unique identifier assigned to the case created on AirMDR services	ASO-13812
COMPLETION TIME	The timestamp indicating when the playbook finished executing for a given alert.	May 05 2025, 11:34 AM
Content	Alert content shared with AirMDR services	Dummy content

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Send Alerts via Webhook (API call) to AirMDR

✨ Step-by-Step for End Users

📋 Quick Example: Sending Alert to AirMDR via Webhook

AirMDR Alerts Dashboard UI

​✨ Step-by-Step for End Users

​📋 Quick Example: Sending Alert to AirMDR via Webhook

​AirMDR Alerts Dashboard UI

✨ Step-by-Step for End Users

📋 Quick Example: Sending Alert to AirMDR via Webhook

AirMDR Alerts Dashboard UI