SIEM Audit Webhook Templates

​

Event Contract (input)

• X-Ghostable-Timestamp
• X-Ghostable-Signature

• id (event id)
• type (event type)
• occurred_at (timestamp)
• organization.id
• actor.id / actor.email
• target.project_id / target.environment_id
• metadata (event-specific context)

​

Recommended Normalized Fields

​

Datadog Template

1. Create an HTTP intake endpoint (or intermediary worker).
2. Verify signature before forwarding to Datadog Logs intake.
3. Add pipeline remappers:
   • type -> event.action
   • id -> event.id
   • organization.id -> organization.id
   • actor.email -> usr.email
4. Create monitors:
   • high rate of push_force_overwrite
   • webhook delivery failures
   • repeated version conflicts

• event.action
• organization.id
• ghostable.environment_id
• usr.email

​

Splunk Template

• event_id = id
• event_type = type
• org_id = organization.id
• actor_email = actor.email

index=security sourcetype=ghostable:audit type=push_force_overwrite
| stats count by organization.id, actor.email
| where count > 5

index=security sourcetype=ghostable:audit type=version_conflict
| timechart span=15m count by organization.id

​

Elastic Template

• id -> event.id
• type -> event.action
• occurred_at -> @timestamp
• actor.email -> user.email
• organization.id -> organization.id

1. json processor (if body wrapped as string)
2. date processor for occurred_at
3. rename processors for ECS fields
4. set processor for event.dataset=ghostable.audit

event.dataset:"ghostable.audit" and event.action:"push_force_overwrite"

​

Operational Checks

• Validate signatures and enforce timestamp drift checks before ingest.
• Deduplicate by id to reduce replay noise.
• Keep a dashboard for:
  • overwrite activity (push_force_overwrite)
  • conflict frequency (version_conflict)
  • webhook delivery reliability using Ghostable metrics endpoint.