> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/alerting/how-do-i-create-custom-webhook-payloads-with-dynamic-placeholders-for-alerts-in-enginsight.md).

# How do I create custom webhook payloads with dynamic placeholders for alerts in Enginsight?

Webhooks allow you to connect alerts to third-party applications so that you can receive notifications outside the Enginsight platform, for example in a messenger or an external ticketing system.

For this, Enginsight sends an HTTP request, typically POST, to the specified webhook URL and includes a payload, that is, specific content in JSON format.

{% hint style="success" icon="lightbulb-exclamation" %}
For more information on how to create a webhook in the Enginsight platform, see the Enginsight Manual: [Add Webhook](https://docs.enginsight.com/docs/manual/english/platform-usage/alerts/webhooks/add-webhook)
{% endhint %}

***

## Custom Payloads With Dynamic Placeholders

When adding a webhook in the Enginsight platform, you can specify a custom payload in which you can use dynamic placeholders.

When an alert for which a webhook has been defined is triggered, Enginsight replaces these placeholders with the actual values before sending the HTTP request to the specified webhook URL.

### Available Placeholders

Enginsight provides the following placeholders:

<table><thead><tr><th width="353.01953125">Placeholder</th><th width="89.0390625">Data type</th><th>Description</th></tr></thead><tbody><tr><td><code>alert_id</code></td><td>String</td><td>Unique identifier of the alert</td></tr><tr><td><code>alert_name</code></td><td>String</td><td>Name of the alert</td></tr><tr><td><code>alert_severity</code></td><td>String</td><td>Criticality of the alert</td></tr><tr><td><code>issue_id</code></td><td>String</td><td>Unique identifier of the occurrence (issue or incident) that was triggered by the alert</td></tr><tr><td><code>organisation_id</code></td><td>String</td><td>Unique identifier of the organization affected by the alert</td></tr><tr><td><code>organisation_name</code></td><td>String</td><td>Name of the organization affected by the alert</td></tr><tr><td><code>platform</code></td><td>String</td><td>URL at which the Enginsight platform can be accessed</td></tr><tr><td><code>reference_conditions[x].groups['key']</code></td><td>String</td><td><p>Value of a field in a <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/siem/workflows">SIEM workflow</a>:</p><ul><li><code>x</code> must be an integer value</li><li><code>'key'</code> must match the field name as specified in the workflow, for example <code>'gen.username'</code></li></ul><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Please note</strong>: This placeholder is only available for the <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/alerts/overview/add-alert#step-1-alert-type">alert type</a> <strong>Workflow (SIEM)</strong>.</p></div></td></tr><tr><td><code>reference_displayName</code></td><td>String</td><td>Display name of the object to which the alert applies</td></tr><tr><td><code>reference_id</code></td><td>String</td><td>Unique identifier of the object to which the alert applies</td></tr><tr><td><code>reference_severity</code></td><td>String</td><td><p>Severity of a SIEM workflow</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Please note</strong>: This placeholder is only available for the <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/alerts/overview/add-alert#step-1-alert-type">alert type</a> <strong>Workflow (SIEM)</strong>.</p></div></td></tr><tr><td><code>reference_type</code></td><td>String</td><td>Type of object to which the alert applies</td></tr></tbody></table>

***

### Structure of a Payload With Placeholders

The following conditions must be met so that Enginsight can correctly replace the placeholders in use and send the HTTP request to the webhook URL:

* The payload must be valid JSON.
* Placeholders must be enclosed in double curly braces `{{...}}`, for example `{{alert_severity}}`.
* If your target system expects strings, the placeholders must additionally be enclosed in double quotation marks `"{{...}}"`, for example `"{{alert_severity}}"`.
* If your target system expects numbers or Boolean values, double quotation marks only need to be used if your target system also accepts strings.

You can choose the names of the JSON keys freely.

***

### Examples of Custom Payloads

In the following example payloads, we assume that you are using an external ticketing system. When a ticket is created for an alert triggered in the Enginsight platform, this system expects the value **severity**.

This means that you must use the placeholder `{{alert_severity}}` in your custom payloads to pass the urgency of a triggered alert, or the placeholder `{{reference_severity}}` to pass the severity of a SIEM workflow.

#### Example 1: Specifying the Criticality of an Alert as a Separate Key-Value Pair

<pre><code>{ 
<strong>"severity": "{{alert_severity}}", 
</strong>"alert_id": "{{alert_id}}", 
"title": "{{alert_name}}" 
}
</code></pre>

#### Example 2: Specifying the Criticality of an Alert Within Custom Text

<pre><code>{ 
"issue_id": "{{issue_id}}", 
<strong>"description": "The alert {{alert_name}} has severity {{alert_severity}}." 
</strong>}
</code></pre>

#### Example 3: Specifying the Severity of a SIEM Workflow

<pre><code>{
"title": "{{alert_name}}",
<strong>"severity": "{{reference_severity}}",
</strong>"username": "{{reference_conditions[0].groups['gen.username']}}",
"hostname": "{{reference_conditions[0].groups['gen.hostname']}}"
}
</code></pre>

***

## Standard Templates for Webhook Payloads

If you do not want to specify a complete custom payload, you can also use one of the standard templates and add JSON keys and dynamic placeholders as needed.

{% hint style="success" icon="lightbulb-exclamation" %}
For more information on the available standard templates for webhook payloads, see the Knowledge Base: [Which standard templates for webhook payloads are available for alerts in Enginsight?](/docs/knowledge-base/english/alerting/which-standard-templates-for-webhook-payloads-are-available-for-alerts-in-enginsight.md)
{% endhint %}

***