Skip to main content
Calseta ingests alerts from any source via webhooks. Each source has a dedicated plugin that validates, normalizes, and extracts indicators from the raw payload.

​
Supported Sources

Microsoft Sentinel

Azure-native SIEM. Forward alerts via Logic Apps or Automation Rules.

Elastic Security

Elastic SIEM. Forward alerts via Elastic webhook actions.

Splunk

Splunk Enterprise Security. Forward alerts via webhook alert actions.

Generic Webhook

Any source that can POST JSON. Use the generic format for unsupported SIEMs.

​
How Ingestion Works

Source System ──POST──▶ /v1/ingest/{source_name} ──▶ 202 Accepted
                              │
                    ┌─────────┴──────────┐
                    │ 1. Validate payload │
                    │ 2. Normalize fields │
                    │ 3. Extract indicators│
                    │ 4. Save alert + indicators│
                    │ 5. Enqueue enrichment│
                    └────────────────────┘
  1. Validate — the source plugin checks the payload structure
  2. Normalize — maps source-specific fields to Calseta’s agent-native schema
  3. Extract indicators — pulls IPs, domains, hashes, URLs, emails, accounts from the payload
  4. Save — persists the normalized alert and indicators to the database
  5. Enqueue — enrichment and agent dispatch are queued for async processing
The endpoint returns 202 Accepted within 200ms. All enrichment and dispatch happen asynchronously.

​
Webhook Signature Verification

Each source can verify webhook signatures to ensure payloads haven’t been tampered with. Configure the webhook secret via environment variables:
VariableSource
SENTINEL_WEBHOOK_SECRETMicrosoft Sentinel
ELASTIC_WEBHOOK_SECRETElastic Security
SPLUNK_WEBHOOK_SECRETSplunk
Signature verification is optional but recommended for production deployments.

​
Normalized Alert Schema

Regardless of source, all alerts are normalized to:
FieldTypeDescription
titlestringAlert title
severitystringPending, Informational, Low, Medium, High, Critical
occurred_attimestampWhen the event occurred (from source)
source_namestringWhich source sent the alert
statusstringInvestigation lifecycle: Open → Triaging/Escalated → Closed
enrichment_statusstringSystem-managed: Pending → Enriched/Failed
tagsstring[]Alert tags
raw_payloadobjectOriginal source payload (preserved in full)

​
Adding Custom Sources

Calseta’s source system is plugin-based. See Adding Alert Sources for a step-by-step guide to building your own source integration.