SOAR Integration
Forward security events from Clevername to your existing SIEM or SOAR platform. Configure webhooks, manage API keys, and control which event types are forwarded for centralized security monitoring.
How it works
Clevername pushes security events to your SOAR/SIEM platform via webhooks. When a configured event type occurs (DLP hit, tool drift, emergency control, etc.), the platform sends an HTTP POST to your webhook URL with the event payload in JSON format.
Supported event types
- dlp_detection — CleverGuard content scanning findings.
- tool_drift — Agent attempted to use a tool outside its guardrail scope.
- model_drift — Agent attempted to use an unapproved model.
- rate_limit — Agent exceeded its rate or budget limits.
- circuit_breaker — Circuit breaker tripped (auto or manual).
- emergency_control — Admin-initiated pause, key revocation, or org-wide stop.
- approval_request — High-risk action triggered a SignedApproval request.
- audit_event — General audit trail entries (configurable filter).
SOAR API keys
Each webhook connection uses a dedicated SOAR API key for authentication. Keys are scoped to the organization and can be rotated independently without affecting other integrations. Clevername signs each webhook payload with the API key using HMAC-SHA256.
Open the SOAR integration panel
Navigate to Security → SOC Console and scroll to the SOAR Integrations panel, or go to Security → Integrations for the dedicated configuration page.
Add a webhook endpoint
Click Add Webhook and enter:
- Endpoint URL — The HTTPS URL of your SIEM/SOAR webhook receiver.
- Name — A descriptive label (e.g., “Splunk Production”).
- Event types — Select which event types to forward. Start with all and narrow down.
Copy the SOAR API key
After creating the webhook, a SOAR API key is generated. Copy it and configure it in your SIEM/SOAR platform for payload signature verification. The key is shown only once — store it securely.
Test the connection
Click Send Test Event to send a sample payload to your endpoint. Check your SOAR platform to confirm receipt. The test event has a test: true flag so your platform can distinguish it from real events.
Monitor delivery health
The SOAR panel shows delivery status for each webhook: green (healthy, all deliveries succeeding), yellow (some failures, retrying), or red (endpoint unreachable, deliveries paused). Failed deliveries are retried with exponential backoff up to 3 times.
Webhook payload format
Each webhook payload includes a standard envelope with the event type, timestamp, organization ID, and the event-specific data. The payload is signed with HMAC-SHA256 using your SOAR API key, delivered in the X-Clevername-Signature header.