Splunk SOAR

Webhook Authentication in Splunk SOAR 6.4.1

soar_developer
New Member

Hi all,

I'm working on a Splunk SOAR connector where we plan to add support for webhooks (introduced in SOAR v6.4.1), allowing the connector to receive data from external sources. I see there's an option to enable authentication for the webhook, but after enabling it, I'm unsure what type of information needs to be included in the request.

I've tried using basic authentication and an auth token, but neither worked. Could someone please guide me on what information should be included in the request once authentication is enabled?

soar_developer_0-1753866373986.png

Labels (2)
0 Karma

PrewinThomas
Builder

@soar_developer 

when you enable authentication, it typically expects a ph-auth-token header.

Eg:
POST /rest/handler/<your_app>_<your_app_id>/... HTTP/1.1
Host: <your_soar_instance>
Content-Type: application/json
ph-auth-token: <your_generated_token>

Refer
#https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/...

 


Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

0 Karma

soar_developer
New Member

Hi @PrewinThomas , thanks for the reply.

I tried using the ph-auth-token, but it's not working.

It works for APIs like /rest/container/ and /rest/artifact/,
but not for the /webhook endpoint.

Ref: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-clou...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...