Настройка Webhooks

{
  "id": "wh_evt_9f82a1c4d7e6",
  "event": "endpoint.down",
  "timestamp": "2025-01-14T08:32:17Z",
  "webhook_id": "wh_3b71f092",
  "account_id": "acc_vanta_prod_001",
  "data": {
    "endpoint_id": "ep_msk_api_04",
    "endpoint_name": "MSK-API-PROD",
    "url": "https://api.example.ru/v2/health",
    "previous_status": "up",
    "current_status": "down",
    "last_success": "2025-01-14T08:27:01Z",
    "first_failure": "2025-01-14T08:32:17Z",
    "failure_count": 3,
    "last_response_code": 502,
    "last_response_time_ms": null,
    "check_interval_sec": 60,
    "group": "production"
  }
}

How to verify: Compute HMAC-SHA256 over the raw request body using your webhook secret as the key. Compare the result with the value in X-VantaStatus-Signature header. The signature format is sha256=<hex>. Reject any request where the signature does not match or the timestamp in X-VantaStatus-Timestamp is more than 5 minutes old.

// Node.js example
const crypto = require('crypto');

function verifySignature(rawBody, signature, secret) {
  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret)
      .update(rawBody)
      .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

1. In Slack, go to Apps → Build → Your Apps → Create New App. Enable Incoming Webhooks and add a new webhook to your target channel (e.g., #monitoring-alerts). Copy the webhook URL.

2. In VantaStatus dashboard, navigate to Settings → Webhooks → Add Webhook. Set the URL to your Slack webhook URL. Add these custom headers:
Content-Type: application/json

3. Use a formatter function or a middleware endpoint to transform the VantaStatus payload into Slack's block format. A minimal payload looks like:

{
  "channel": "#monitoring-alerts",
  "username": "VantaStatus Bot",
  "icon_emoji": ":warning:",
  "blocks": [
    {
      "type": "header",
      "text": {
        "type": "plain_text",
        "text": "🔴 MSK-API-PROD is DOWN"
      }
    },
    {
      "type": "section",
      "fields": [
        {
          "type": "mrkdwn",
          "text": "*URL:*\nhttps://api.example.ru/v2/health"
        },
        {
          "type": "mrkdwn",
          "text": "*Status:*\n502 Bad Gateway (3 failures)"
        }
      ]
    }
  ]
}

1. Create a Jira Automation rule: Trigger — Webhook. Set the payload structure to match VantaStatus events. The rule will fire when a POST arrives at your generated Jira webhook URL.

2. In the automation action, configure Create Issue with these mappings:
Project: OPS (Operations)
Issue Type: Incident
Summary: {{data.endpoint_name}} — {{data.current_status}}
Labels: monitoring, {{data.group}}
Description: include data.url, data.failure_count, and data.last_response_code

3. Copy the Jira webhook URL into your VantaStatus webhook configuration. Set the event filter to endpoint.down only to avoid creating issues for recovery events — those can be handled by a separate automation rule that transitions the issue to Done when endpoint.up arrives.

Tip: Use the data.group field to route production incidents to OPS and staging incidents to QA by adding a Smart Value condition in Jira Automation.

If you run your own monitoring stack (Grafana, Datadog, Prometheus Alertmanager, or an internal incident platform), you can point a VantaStatus webhook directly to an HTTP receiver. Below is a minimal Express.js receiver that validates the signature, logs the event, and forwards it to a local message queue.

const express = require('express');
const crypto = require('crypto');
const app = express();

const WEBHOOK_SECRET = process.env.VANTA_WEBHOOK_SECRET;

app.post('/webhooks/vantastatus', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-vantastatus-signature'];
  const timestamp = req.headers['x-vantastatus-timestamp'];

  // Verify timestamp freshness (5-minute window)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > 300) {
    return res.status(401).send('Stale timestamp');
  }

  // Verify HMAC signature
  const expected = 'sha256=' +
    crypto.createHmac('sha256', WEBHOOK_SECRET)
      .update(req.body)
      .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(req.body);
  console.log(`[${payload.event}] ${payload.data?.endpoint_name || 'unknown'}`);

  // Forward to your internal queue (Redis, RabbitMQ, etc.)
  // queue.publish('vantastatus.events', payload);

  res.status(200).send('OK');
});

app.listen(3000);

Idempotency note: VantaStatus may deliver the same event more than once during network partitions. Use the id field (wh_evt_9f82a1c4d7e6) as a deduplication key. Store processed event IDs in a set or a database with a TTL of at least 24 hours. Events with the same id are guaranteed to carry identical data payloads.