Skip to main content
Calseta ingests alerts from any source via webhooks. Each source has a dedicated plugin that validates, normalizes, and extracts indicators from the raw payload.

​
Supported Sources

Microsoft Sentinel

Azure-native SIEM. Forward alerts via Logic Apps or Automation Rules.

Elastic Security

Elastic SIEM. Forward alerts via Elastic webhook actions.

Splunk

Splunk Enterprise Security. Forward alerts via webhook alert actions.

Generic Webhook

Any source that can POST JSON. Use the generic format for unsupported SIEMs.

​
How Ingestion Works

  1. Validate — the source plugin checks the payload structure
  2. Normalize — maps source-specific fields to Calseta’s agent-native schema
  3. Extract indicators — pulls IPs, domains, hashes, URLs, emails, accounts from the payload
  4. Save — persists the normalized alert and indicators to the database
  5. Enqueue — enrichment and agent dispatch are queued for async processing
The endpoint returns 202 Accepted within 200ms. All enrichment and dispatch happen asynchronously.

​
Webhook Signature Verification

Each source can verify webhook signatures to ensure payloads haven’t been tampered with. Configure the webhook secret via environment variables: Signature verification is optional but recommended for production deployments.

​
Normalized Alert Schema

Regardless of source, all alerts are normalized to:

​
Adding Custom Sources

Calseta’s source system is plugin-based. See Adding Alert Sources for a step-by-step guide to building your own source integration.