No matching documentation found

Custom Webhooks

The Custom Webhook plugin for Login AlertX sends structured JSON security payloads directly to any HTTP or HTTPS endpoint whenever a monitored event occurs. Built for developers, sysadmins, and security teams, it seamlessly connects Login AlertX to custom APIs, internal dashboards, SIEM systems (Splunk, Elastic, Microsoft Sentinel), and workflow automation platforms (n8n, Zapier, Make).

What You Need

  • An active Personal, Business, or Server license (or 30-day free trial)
  • A reachable HTTP or HTTPS endpoint URL configured to accept POST requests
  • (Optional) Authentication credentials, such as an API key or Bearer token

Step 1: Configure the Webhook in Login AlertX

  1. Open Login AlertX from the system tray.
  2. In the sidebar navigation, navigate to Notification Channels.
  3. Locate the Custom Webhook plugin card and click it to open its configuration panel.
  4. Toggle Enable Webhook Alerts to On.
  5. In the Webhook URL field, enter the full destination URL (e.g. https://api.yourdomain.com/v1/security-events).

Step 2: Add Custom HTTP Headers (Optional)

If your webhook receiver requires authentication or custom routing headers, you can define them directly in the settings panel:

  • Enter each header on a new line in Key: Value format: 
    Authorization: Bearer secret_token_xyz123
X-API-Key: custom_security_token_456
X-Environment: Production
  • Login AlertX automatically attaches Content-Type: application/json and User-Agent: LoginAlertX/4.x to all outbound requests.

Step 3: Security & Media Attachments

Configure which forensic evidence is transmitted with the webhook:

  • Include Media Evidence: When enabled, forensic media (webcam snapshots and desktop screenshots) are converted to Base64 data URIs or multipart boundaries within the payload.
  • Include Machine Telemetry: Attaches hardware metadata (CPU utilization, active RAM, public & local IP addresses, and machine uptime).

Step 4: Test the Connection

  1. With the Custom Webhook panel open, click Test Webhook.
  2. Login AlertX sends a standardized test payload to your endpoint.
  3. The settings panel will display the server’s HTTP response code (e.g. ✔ HTTP 200 OK).
  4. Click Save Settings to apply your configuration.

JSON Payload Format

Outgoing webhook alerts are structured as standard JSON objects:

{
  "version": "4.4.0",
  "eventType": "Logon",
  "eventLabel": "User Login Detected",
  "timestamp": "2026-10-31T10:30:15.123Z",
  "machineName": "DESKTOP-PC01",
  "username": "admin",
  "ipAddress": "198.51.100.24",
  "isRemote": false,
  "anomalyScore": 0.14,
  "riskLevel": "Low",
  "location": {
    "latitude": 37.7749,
    "longitude": -122.4194,
    "city": "San Francisco",
    "country": "United States"
  },
  "attachments": {
    "hasWebcamPhoto": true,
    "hasScreenshot": true,
    "hasAudio": false
  }
}

Tips & Troubleshooting

  • HTTPS Recommended: We strongly advise using HTTPS endpoints so all security payloads and account tokens are encrypted in transit.
  • Offline Resiliency: If your network drops or your server is temporarily unreachable, Login AlertX stores the alert in its local SQLite transactional outbox and retries delivery with exponential backoff until the server responds with a 2xx status.
  • Fast Response Times: Your webhook receiver should return an HTTP 200 OK or 202 Accepted promptly (< 5 seconds). Lengthy downstream processing should be queued asynchronously by your receiver.

Next Steps

Scroll to Top