Agent Webhooks

curl -X POST http://localhost:8000/v1/agents \
  -H "Authorization: Bearer cai_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Investigation Agent",
    "webhook_url": "https://your-agent.example.com/webhook",
    "auth_header": "Bearer your-agent-secret",
    "trigger_filter": {
      "min_severity": "High",
      "source_names": ["sentinel", "elastic"]
    }
  }'

{
  "event": "alert.enriched",
  "alert": {
    "uuid": "9f2a-b3c1-...",
    "title": "Impossible Travel Detected",
    "severity": "High",
    "source_name": "sentinel",
    "status": "Open",
    "occurred_at": "2025-01-15T10:28:00Z",
    "tags": ["identity", "auth"],
    "raw_payload": { "...": "original source data" },
    "_metadata": {
      "generated_at": "2025-01-15T10:30:05Z",
      "alert_source": "sentinel",
      "indicator_count": 3,
      "enrichment": {
        "succeeded": ["virustotal", "abuseipdb"],
        "failed": [],
        "enriched_at": "2025-01-15T10:30:05Z"
      },
      "detection_rule_matched": true,
      "context_documents_applied": 2
    }
  },
  "indicators": [
    {
      "type": "ip",
      "value": "185.220.101.47",
      "malice": "Malicious",
      "enrichment_results": {
        "virustotal": {
          "extracted": { "malicious_count": 14, "country": "DE" }
        },
        "abuseipdb": {
          "extracted": { "abuse_confidence_score": 97 }
        }
      }
    }
  ],
  "detection_rule": {
    "name": "Suspicious Auth - Impossible Travel",
    "mitre_tactics": ["TA0001"],
    "mitre_techniques": ["T1078"],
    "documentation": "## Overview\nDetects impossible travel..."
  },
  "context_documents": [
    {
      "title": "Identity IR Runbook",
      "doc_type": "runbook",
      "content": "## Scope\n..."
    }
  ],
  "workflows": [
    {
      "uuid": "wf-abc123-...",
      "name": "Revoke User Session",
      "documentation": "Revokes all active sessions...",
      "approval_mode": "always",
      "risk_level": "high"
    }
  ]
}

curl -X POST http://localhost:8000/v1/alerts/{uuid}/findings \
  -H "Authorization: Bearer cai_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "Confirmed malicious login from Tor exit node",
    "confidence": 0.95,
    "recommended_actions": [
      "Revoke all active sessions",
      "Force password reset",
      "Review recent file access"
    ],
    "details": {
      "source_ip_analysis": "Known Tor exit node, 14/90 VT detections",
      "user_risk": "No recent travel, MFA bypassed"
    }
  }'

curl -X PATCH http://localhost:8000/v1/alerts/{uuid} \
  -H "Authorization: Bearer cai_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"status": "Triaging"}'