detectors

OSA Webhook API

GET/api/detectors

List detectors

Security Analytics detectors with a per-trigger summary (which channels each trigger notifies, whether it's wired to osawebhook, enabled state). A channel alone does not fire the webhook — a detector trigger must be wired to it and the detector enabled.

Responses

200 Detectors

totalnumberrequired

detectorsDetectorSummary[]required

idstringrequired

namestringrequired

detectorTypestring

windows / network / cloudtrail / …

enabledbooleanrequired

notifiesOsabooleanrequired

triggersobject[]required

idstringrequired

namestring

severitystring

"1".."5" (1 = highest)

destinationIdsstring[]required

Notification channel ids this trigger's actions send to.

cURL

curl -X GET https://osawebhook.defenderx.sentrixsolution.com/api/detectors

JavaScript

const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/detectors", {
  method: "GET"
});
const data = await res.json();

Response 200

{
  "total": 0,
  "detectors": [
    {
      "id": "string",
      "name": "string",
      "detectorType": "string",
      "enabled": true,
      "notifiesOsa": true,
      "triggers": [
        {
          "id": "string",
          "name": "string",
          "severity": "string",
          "destinationIds": [
            "string"
          ]
        }
      ]
    }
  ]
}

GET/api/detectors/{id}

Get one detector (full, writable form)

Path parameters

idstringrequired

Responses

200 The detector (`{ id, version, detector }`)404 Unknown detector id

object

cURL

curl -X GET https://osawebhook.defenderx.sentrixsolution.com/api/detectors/{id}

JavaScript

const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/detectors/{id}", {
  method: "GET"
});
const data = await res.json();

Response 200

{}

PATCH/api/detectors/{id}

Enable/disable a detector, or wire/unwire a trigger to a channel

Discriminated by body: `{ enabled: boolean }` toggles the detector (enabling sends live alerts to the wired channel); `{ action: 'wire'|'unwire', triggerId, channelId, template? }` adds/removes a notification action on that trigger (idempotent by channelId; default template is the Sigma osawebhook payload).

Path parameters

idstringrequired

Request body

object | object

Responses

200 Applied401 Missing/wrong webhook secret (only when WEBHOOK_SECRET is set)422 Missing/invalid body discriminator

object

cURL

curl -X PATCH https://osawebhook.defenderx.sentrixsolution.com/api/detectors/{id} \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d 'null'

JavaScript

const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/detectors/{id}", {
  method: "PATCH",
  headers: {
    "Authorization": `Bearer ${token}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify(null)
});
const data = await res.json();

Response 200

{}