Webhook Events as Logs

Webhooks provide a way for one system to send real-time data to another system as soon as an event occurs. In LogicMonitor, webhooks enable external platforms to send log events directly into the platform for ingestion using HTTP POST requests. This feature enables capturing of event-driven data such as metrics, alerts, notifications as logs in near real time, helping you centralize log collection.

Webhook Events as Logs provides the following benefits:

• Instant log delivery—Receive logs instantly from systems that support webhooks, without requiring custom Collectors or scheduled queries.
• Stronger correlation— Correlate external alerts with existing logs in LogicMonitor for deeper insights.
• Broader ingestion options—Ingest data from cloud services, SaaS platforms, and cloud-managed networking platforms.
• Prebuilt modules—Use prebuilt modules in LogicMonitor Exchange, such as those designed for Cisco Meraki.

Webhook LogSources further defines how inbound webhook data should be processed and stored.

The following steps occur when an external system sends a message to the webhook endpoint:

1. The request is received by the LogicMonitor webhook listener.
2. The associated LogSource configuration determines how the message is parsed and mapped.
3. Logs are ingested into LogicMonitor, where they can be visualized, correlated, and used for alerting.

The following diagram illustrates the webhook workflow:

For more information, refer to Webhook LogSource Configuration. 

Requirements for using a Webhook LogSource to Ingest Messages

To configure webhook events that send log messages to LogicMonitor, you need the following:

• An API Only User in LogicMonitor with “Manage” permission for Logs & Traces
• An appropriate webhook name.
  For example:
  • Meraki_Webhook
  • Verkada_Webhook
• A valid Receiver URL (Callback URL) to the LogicMonitor portal
• Authentication credentials required by the vendor.

The following sections describe the vendor-specific requirements.

Requirements for Cisco Meraki

To configure Cisco Meraki webhook events, you need the following:

• A Receiver URL (Callback URL) for your LogicMonitor portal.
  For example: https://portalname.logicmonitor.com/rest/api/v1/webhook/ingest/sourceNameIn this example,
  • The sourceName is included in webhook messages to identify the origin of the data.
  • You can also configure a LogSource to filter by sourceName.
  • Each sourceName should be unique (for example, Meraki+CustomerName).
• A Bearer Token assigned to the LogicMonitor API Only User.
  For example:
  HTTP Header Key: Authorization
  HTTP Header Value: Bearer <BearerTokenHere>
  Note: The word Bearer, followed by a single space, must precede the LogicMonitor Bearer Token.
  For more information, see Adding a Bearer Token.

Requirements for Verkada

To configure Verkada webhook events using HMAC authentication, you need the following:

• A Receiver URL (Callback URL) for your LogicMonitor portal.
  For example: https://portalname.logicmonitor.com/rest/api/v1/webhook/ingest/hmac/verkada?access-id=<access_id>

• A valid LogicMonitor Access ID.The Access ID is included as the access-id query parameter in the Receiver URL.
• A valid LogicMonitor Access Key.The Access Key acts as the shared secret used by Verkada to generate HMAC signatures for webhook requests.
• An API token generated for the LogicMonitor API Only User.
  For more information, see Creating an API Token.
• A Verkada webhook configuration that uses the Receiver URL, Access ID, and Access Key.
  For more information, see the Set up Webhooks in the Verkada documentation.