Webhook Data Ingestion

D3 SOAR offers two types of Integrations: System and Custom. Custom integrations are users' in-house tools used to fit unique needs using the Codeless Playbook, REST API Request Method, or Python implementation methods.

Webhook Setup for Event Ingestion

D3’s Webhook ingestion method allows custom integrations to send event or incident data in JSON format to be investigated in the D3 vSOC platform. This allows real-time, controlled event or incident data ingestion for SOC teams. To set up a webhook for event ingestion, follow the below steps:

Navigate to Configuration > Integration to add a custom integration.
Click on the Fetch Event or Fetch Incident integration command.
Toggle on the Remote Command toggle under the Webhook Authentication section.
Select the desired authentication method. In this case, we will use the API Key option.
In the Setup API Keys window, click on the + button (adjacent to ALL SITES, INTERNAL SITES, or CLIENT SITES depending on where you want the API key to be accessible) to generate a new key.
Select a site in the Generate Event Ingestion Key popup. The sites available for selection are determined by the section in which you clicked the + button in the previous step.
Enter an alias for your API key.
Click on the Generate button.
Test out the D3 webhook and your API Key using the Request URL, Request Header Key and Request Header Value.

Event and Incident Intake Field Mapping

Incident and Event Data Ingestion via Webhook will also require Event Field Mapping and Incident Field Mapping.

Event Intake Specific Field Mapping

The Event Mapping will need to be configured via the Event Field Extraction Mapping located in the overview of an event intake command.

For an Event intake Integration, the fields extracted will need to be mapped to the fields using D3 Data Model or mapped to the custom fields defined by the user.

Below is an example of Field Extraction Mapping for the system Datadog Integration.

In the fetchEvent Command page, click on the Setup Field Extraction Mapping button.

Click on the Edit Event Source button to configure the default Event Source.

Edit Event Source to enter the Main JSON Path for the Datadog event data: $.logs
Click on the Save button.

Click on + Add Field to add a field to edit map fields from the event source to fields within the D3 Data Model.

Enter a name for Field Name: Event Type

READER NOTE

The dropdown lists all the standardized field names within the D3 Data Model.

Select a Source Field: .content.attributes.evt.name

Enter or select a Source Type from the dropdown: Text

(Optional): If you select the "Show in Incident" option, the corresponding field will appear in the "Key Information" section of the Event Summary in Incident Overvew. You can also specify the order in which the field should be displayed. If no order number is specified, the field will be displayed last. In case none of the field mappings have the "Show in Incident" option enabled, the "Events Summary" section will display a default set of field values.

READER NOTE

Artifact Settings is used to configure source specific paths in artifact identities. For more details on how to configure artifacts, please refer to this document.

Click Save and then continue the other fields mapping following the steps from 2-8 until all desired field mappings are complete.

READER NOTE
The Field Type column on this screen will display whether a field is user defined or a built-in field.

READER NOTE

For more granular field mapping, you can add one or more custom Event Sources. This feature allows you to map specific third party data fields to the D3 Data Model or user-defined field when a search string is satisfied.

Configuring a New Event Source

Click the + Add Event Source button.

Complete the following fields on the Event Source form:

Event Source Name: Enter a custom event source name.

Search String: Enter a search string using the following format: {jsonpath}= value.

Order Priority: This field allows the SOC Engineer to determine which custom event source takes priority when field mappings apply to one or more event sources (the lowest number ranks the highest priority).

Click the Save button to confirm changes.

Result: The newly created Event Source will appear in the drop-down list on the Field Extraction window.

Source Field Types

D3 SOAR utilizes the Source Field Types to define how the mapped event data will be formatted within the application. The table below outlines the different source field types available and examples of how to use them.

Source Field Type	Description
Text	Text: The source field will be formatted as text. Example: Event Type
Datetime	Datetime: The source field will be formatted as a datetime. Default datetime format: `yyyy-MM-dd HH:mm:ss` Other datetime formats can be: UnixTimeSeconds, UnixTimeMilliseconds
Regex	Regular Expression: The source field will be formatted as a regular expression with capture groups. Example: `ipAddress:(.+)\S`  Source Format: Get data from the capture groups. Example: $1
Conditions	Condition: Set conditions that must be met before the event field maps the data. Example: `{Fieldname: "EventID", OP: "eq", Value: "7", "ParseAsSourceType": 1, "ParseAsSourceFormat": ""}`
Placeholder	Placeholders: Combine previously mapped fields into a new String. Use the field name (not display name) of D3 data model fields or the user-defined field name. Put the field name in {} and construct a template in the Source Format. There are some system default placeholders that can also be used. These are found by clicking on system variables.

Incident Intake Specific Field Mapping

Event Field Mapping

Event Field Mapping will also need to be completed for Incident Intake so that any child events that get ingested along with the Incident will be properly mapped.

Please note, the event field mappings are shared across both the Event Intake and Incident Intake Command. As such, you will only need to configure the event field mapping once.

Please add the same JSON Path as the Event Intake required specifically to correctly link the Events to the Incident

Incident Field Mapping

The Incident Field Mapping is only available for the Incident Intake Command.

The Mapping allows the SOC Engineer to determine the following:

Title
Description
Severity
Incident Type
Incident Creator
Incident Owner
Incident Playbook
Due in Date
Unique Key

The SOC Engineer will need to input the Main JSON Path and define the Default Incident Source. For more flexibility, the SOC engineer can also define the mapping based on the site.