Webhooks for Event Notifications

The Webhook feature allows administrators to forward real-time or batched event data from the Netgraph platform to external systems, such as SIEM tools or log management systems. This enables advanced monitoring, logging, and analysis of network-related events—such as guest logins or returning users—across multiple environments.

Key Features #

Multiple Destinations: You can create and configure multiple webhooks for different endpoints.
Custom Payload Delivery: Events are delivered as structured JSON payloads to the specified Payload URL.
Event Types Supported:
- signin.success: When a user successfully logs in via the captive portal.
- signin.session.resumed: When a returning user is auto-authenticated based on a previous session.

Delivery Modes #

There are two types of delivery methods:

1. Real-Time (Recommended) #

Sends each event immediately as it occurs.
Ideal for integrations that require near-instant visibility.

2. Batch #

Events are grouped and sent based on:
- Max Batch Size (e.g. 20,000 events)
- Batch Interval (e.g. every 30 minutes)
Suitable for environments that benefit from bulk delivery or where the receiving system has rate limitations.

Retry Logic #

If the receiving system does not return an HTTP 200 OK status, a retry mechanism is automatically triggered using the following exponential backoff strategy:

Retry after 2 minutes
Then after 4 minutes
Then 8, 16, and 32 minutes
After that, the system will stop retrying and mark the delivery as failed.

This ensures reliable delivery without overwhelming the target system.

Response Tracking #

For each webhook, you can view:

Pending Events: A queue of upcoming batches
Recent Deliveries: Timestamped logs of each attempt
Response Details: Includes request payload, full HTTP response (headers, status code, and body)

This transparency allows for effective troubleshooting and integration health monitoring.

Example Integration: Splunk #

In the provided example:

A batch webhook named Splunk Export sends login event data to a Splunk HEC endpoint.
JSON payloads include user site, email, timestamp, and event type.
Completed batches show status Completed, and delivery time per batch is logged (e.g. 0.45 seconds).
All headers, body, and delivery attempts are logged for auditing.

Summary #

The Webhook module is a powerful tool for integrating the Netgraph authentication system with external platforms. Whether for real-time alerting or log aggregation, it ensures secure and controlled delivery of data with smart retry strategies for maximum reliability.