Using webhook as an alert action, can webhook retry if http status is not ok?

[LPatPSP]

I am considering using webhook as an alert action. One concern is that if the webhook URL is temporarily not available, we may miss the alert action. Is it likely to configure webhook to retry when the webhook call http status is not ok?

Thanks

[frobinson_splun]

Hi @LPatPSP,
After consulting with some colleagues, retrying is not a supported option for webhooks.

However, you might consider this workaround:

Log an event if and when a webhook fails. Then, run a scheduled search to check for these failure events and alert on them. Set up a webhook alert action on this alert. The webhook can retry the original request. Note that the log event might need to include the original data payload from the first webhook notification.

Hope this is helpful!

[frobinson_splun]

Hi @LPatPSP,
Thanks for your question. I'm checking in with our product and engineering team to see what we can suggest.

Please stay tuned!