Webhook Event Format

Targeted Rule Alerts can deliver events to a webhook. In general, the structure of events will look like this:

{
  "event": "budget_alert",
  "time": "2019-10-07T01:53:27Z",
  "client": {
    "id": 123,
    "name": "Your Organization"
  },
  "payload": {
    "details": "here"
  }
}

The payload of the event depends on the the type of event.

Budget Alerts (budget_alert)

{
  "event": "budget_alert",
  "time": "2019-10-07T01:53:27Z",
  "client": {
    "id": 123,
    "name": "Your Organization"
  },
  "payload": {
    "current_percentage": 103.65825219813962,
    "previous_months_average_spend": 296.9338353384074,
    "previous_7_days_average_spend": 307.8394059229423,
    "estimated_spend": 8791.539850932151,
    "current_budget": 7597.266524324859,
    "segment": <segment data>
  }
}

If the alert is for a segment, the segment field will have the following structure:

{
  "id": 123,
  "title": "your-segment",
  "view": {
    "id": 456,
    "name": "your-view"
  }
}

Spikes in Daily Spending (run_rate_spike)

Run Rate Spikes detect unexpected spikes in your run rate (the amount spent on a given day) versus the average spend over a period of time.

The structure of this event will look like this:

{
  "event": "run_rate_spike",
  "time": "2019-10-07T01:53:27Z",
  "client": {
    "id": 123,
    "name": "Your Organization"
  },
  "payload": {
    "normal_run_rate": 400.0,
    "current_run_rate": 1000.0,
    "variance_percentage": 150.0,
    "day": "2019-04-27T00:00:00+00:00",
    "comparison_period": {
      "starts": "2019-04-20T00:00:00+00:00",
      "ends": "2019-04-26T23:59:59+00:00"
    },
    "last_30_days_total": 16000.0
  d}
}

Rules Becoming Non-Compliant (noncompliant_evaluable_rules)

Noncompliant Rules tracks when a previously-passing rule goes from passing to failing. It can contain multiple rules in a batch, and each rule will have an associated set of resources.

The structure of this event will look like this:

{
  "event": "noncompliant_evaluable_rules",
  "time": "2019-10-05T16:30:48Z",
  "client": {
    "id": 123,
    "name": "Your Organization"
  },
  "payload": {
    "rules": [
      {
        "rule": {
          "id": 123456,
          "name": "EC2 instances have IAM instance profiles",
          "kind": "Custom"
        },
        "resources": [
          {
            "id": "731d05e67c16e96e614440945dec4d763eeace040871b7065de60d63280c9d8c",
            "name": "my-ecs-cluster-member",
            "resource_type": "ec2-instance",
            "aws_region": {
              "code": "ap-southeast-2",
              "name": "Asia Pacific (Sydney)"
            },
            "aws_account": {
              "name": "my prod env",
              "id": "123456789012"
            },
            "arn": "arn:aws:ec2:ap-southeast-2:123456789012:instance/i-0aef123aefaef1230",
            "raw_data": {
              "id": "i-0aef123aefaef1230",
              "name": "my-ecs-cluster-member",
              "type": "c3.large",
              "image": {
                "name": "my-ami-name",
                "public": false,
                "image_id": "ami-0123456789",
                "description": "Test Image"
              },
              "state": "running",
              "region": "ap-southeast-2",
              "platform": null,
              "availability_zone": "ap-southeast-2b",
              "placement_tenancy": "default",
              "average_cpu_past_24_hours": 1.98
            }
          }
        ]
      }
    ]
  }
}

New non-compliant Resources in a Rule (noncompliant_evaluable_resources)

Non-compliant resources tracks when resources start being non-compliant. This occurs when they were passing before but are now failing, or they are newly detected in a failing state.

The payload structure of this event is the same as noncompliant_evaluable_rules, but the semantics are different. In noncompliant_evaluable_rules, the resources are examples, and the rule is the one that has recently become non-compliant. In the case of noncompliant_evaluable_resources, the resources are those that have become non-compliant, and the rules are the ones those resources belong to. The subtle difference is that in this event, the rule could have been non-compliant for a period of time.

The structure of this event will look like this:

{
  "event": "noncompliant_evaluable_resources",
  "time": "2019-10-05T16:30:48Z",
  "client": {
    "id": 123,
    "name": "Your Organization"
  },
  "payload": {
    "rules": [
      {
        "rule": {
          "id": 123456,
          "name": "EC2 instances have IAM instance profiles",
          "kind": "Custom"
        },
        "resources": [
          {
            "id": "731d05e67c16e96e614440945dec4d763eeace040871b7065de60d63280c9d8c",
            "name": "my-ecs-cluster-member",
            "resource_type": "ec2-instance",
            "aws_region": {
              "code": "ap-southeast-2",
              "name": "Asia Pacific (Sydney)"
            },
            "aws_account": {
              "name": "my prod env",
              "id": "123456789012"
            },
            "arn": "arn:aws:ec2:ap-southeast-2:123456789012:instance/i-0aef123aefaef1230",
            "raw_data": {
              "id": "i-0aef123aefaef1230",
              "name": "my-ecs-cluster-member",
              "type": "c3.large",
              "image": {
                "name": "my-ami-name",
                "public": false,
                "image_id": "ami-0123456789",
                "description": "Test Image"
              },
              "state": "running",
              "region": "ap-southeast-2",
              "platform": null,
              "availability_zone": "ap-southeast-2b",
              "placement_tenancy": "default",
              "average_cpu_past_24_hours": 1.98
            }
          }
        ]
      }
    ]
  }
}