Webhook Event Format
Targeted Rule Alerts can deliver events to a webhook. In general, the structure of events will look like this:
{
"event": "budget_alert",
"time": "2019-10-07T01:53:27Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"details": "here"
}
}
The payload of the event depends on the the type of event.
The following examples of events are not an exhaustive list of all the events that can be delivered. This document is a work in progress and will be updated with additional event detail.
Budget Alerts (budget_alert)
{
"event": "budget_alert",
"time": "2019-10-07T01:53:27Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"current_percentage": 103.65825219813962,
"previous_months_average_spend": 296.9338353384074,
"previous_7_days_average_spend": 307.8394059229423,
"estimated_spend": 8791.539850932151,
"current_budget": 7597.266524324859,
"segment": <segment data>
}
}
If the alert is for a segment, the segment field will have the following structure:
{
"id": 123,
"title": "your-segment",
"view": {
"id": 456,
"name": "your-view"
}
}
Spikes in Daily Spending (run_rate_spike)
Run Rate Spikes detect unexpected spikes in your run rate (the amount spent on a given day) versus the average spend over a period of time.
The structure of this event will look like this:
{
"event": "run_rate_spike",
"time": "2019-10-07T01:53:27Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"normal_run_rate": 400.0,
"current_run_rate": 1000.0,
"variance_percentage": 150.0,
"day": "2019-04-27T00:00:00+00:00",
"comparison_period": {
"starts": "2019-04-20T00:00:00+00:00",
"ends": "2019-04-26T23:59:59+00:00"
},
"last_30_days_total": 16000.0 d
}
}
Rules Becoming Non-Compliant (noncompliant_evaluable_rules)
Noncompliant Rules tracks when a previously-passing rule goes from passing to failing. It can contain multiple rules in a batch, and each rule will have an associated set of resources.
The structure of this event will look like this:
{
"event": "noncompliant_evaluable_rules",
"time": "2019-10-05T16:30:48Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"rules": [
{
"rule": {
"id": 123456,
"name": "EC2 instances have IAM instance profiles",
"kind": "Custom"
},
"resources": [
{
"id": "731d05e67c16e96e614440945dec4d763eeace040871b7065de60d63280c9d8c",
"name": "my-ecs-cluster-member",
"resource_type": "ec2-instance",
"aws_region": {
"code": "ap-southeast-2",
"name": "Asia Pacific (Sydney)"
},
"aws_account": {
"name": "my prod env",
"id": "123456789012"
},
"arn": "arn:aws:ec2:ap-southeast-2:123456789012:instance/i-0aef123aefaef1230",
"raw_data": {
"id": "i-0aef123aefaef1230",
"name": "my-ecs-cluster-member",
"type": "c3.large",
"image": {
"name": "my-ami-name",
"public": false,
"image_id": "ami-0123456789",
"description": "Test Image"
},
"state": "running",
"region": "ap-southeast-2",
"platform": null,
"availability_zone": "ap-southeast-2b",
"placement_tenancy": "default",
"average_cpu_past_24_hours": 1.98
}
}
]
}
]
}
}
New non-compliant Resources in a Rule (noncompliant_evaluable_resources)
Non-compliant resources tracks when resources start being non-compliant. This occurs when they were passing before but are now failing, or they are newly detected in a failing state.
The payload structure of this event is the same as noncompliant_evaluable_rules, but the semantics are different. In noncompliant_evaluable_rules, the resources are examples, and the rule is the one that has recently become non-compliant. In the case of noncompliant_evaluable_resources, the resources are those that have become non-compliant, and the rules are the ones those resources belong to. The subtle difference is that in this event, the rule could have been non-compliant for a period of time.
The structure of this event will look like this:
{
"event": "noncompliant_evaluable_resources",
"time": "2019-10-05T16:30:48Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"rules": [
{
"rule": {
"id": 123456,
"name": "EC2 instances have IAM instance profiles",
"kind": "Custom"
},
"resources": [
{
"id": "731d05e67c16e96e614440945dec4d763eeace040871b7065de60d63280c9d8c",
"name": "my-ecs-cluster-member",
"resource_type": "ec2-instance",
"aws_region": {
"code": "ap-southeast-2",
"name": "Asia Pacific (Sydney)"
},
"aws_account": {
"name": "my prod env",
"id": "123456789012"
},
"arn": "arn:aws:ec2:ap-southeast-2:123456789012:instance/i-0aef123aefaef1230",
"raw_data": {
"id": "i-0aef123aefaef1230",
"name": "my-ecs-cluster-member",
"type": "c3.large",
"image": {
"name": "my-ami-name",
"public": false,
"image_id": "ami-0123456789",
"description": "Test Image"
},
"state": "running",
"region": "ap-southeast-2",
"platform": null,
"availability_zone": "ap-southeast-2b",
"placement_tenancy": "default",
"average_cpu_past_24_hours": 1.98
}
}
]
}
]
}
}