How to Send NinjaOne Webhooks Via SIEM

While NinjaOne tracks historical actions taken within the platform, many organizations need to aggregate these logs in a Security Information and Event Management tool – commonly known as a SIEM. This blog discusses how to set up the new SIEM Exporter app in NinjaOne and the process of relaying data from NinjaOne into a SIEM using webhooks that are delivered as the activities occur. You can also retrieve this information via the NinjaOne API.

Before getting started

Webhooks enable real-time event transmission from NinjaOne to your SIEM of choice.
The SIEM Exporter App in NinjaOne allows you to configure webhooks for specific events like device alerts, policy conditions, or integration-specific notifications.
The app separates SIEM alerts from the notifications channel, reducing noise in the Notifications channel.
The app also introduces role-based access to webhooks, ensuring that technicians have appropriate read/write approvals.
Any SIEM that can receive, validate, and process automated HTTP messages sent by another application when a specific event occurs via webhooks works with this application.
The webhook is monitored to ensure the webhook transaction succeeds.
While this SIEM exporter allows you to define a custom webhook integration, other NinjaOne prebuilt integrations can make use of similar webhook structures

How to get started

Technician permissions

Manage technician access through the SIEM Exporter system permission through account or role configuration.

System administrators have full access to the SIEM Exporter by default. To grant Read access to an individual technician or a technician role, set the SIEM Exporter permission in the System section to Allowed. Refer to NinjaOne Platform: Permission Settings for Technicians for more information.

Application setup

Use the SIEM Event Exporter application in NinjaOne to easily configure your SIEM data stream.

Navigate to Administration → Apps → Installed and click +Add app.

Select SIEM Exporter and click Continue in the confirmation dialog.
On the SIEM Exporter application page, click Enable.

Add webhooks

Create a webhook connection to send activity data to your SIEM tool. Enter the webhook destination URL provided by your SIEM or integration vendor. Additional authentication may be required to receive events.

From the SIEM Exporter application, select Webhooks and then click +Add webhook.

Figure 2: Add a webhook through the SIEM Exporter application

The webhook connection will be activated by default. Enter a unique identifier into the Connection name field.
Select one or more Event types from the drop-down menu. You can configure webhooks for specific events like device alerts, policy conditions, or integration-specific notifications.
Enter the Destination URL for the mechanism that will receive data from NinjaOne. A destination can be either an HTTP endpoint or your localhost.
Select All organizations to grant global access, or select Specific organizations to limit access.

Figure 3: Example webhook → General settings (click to enlarge)

Click Header request in the Add webhook dialog sidebar menu to add HTTP headers from your SIEM or vendor, such as authorization tokens. This part of the process can be used to build a shared secret, and may not be required. Your specific SIEM or vendor should inform you if you need to configure one.
Click +Add header and select Generic header or Secured header. We recommend using Generic header when supplying metadata to facilitate data transmission. Use the Secured header to protect sensitive data; it will obscure the Value by default, and you can click the Show password icon to reveal it.

Figure 4: Webhook configuration → Add header request

Enter a Name for your header. This field will only accept the following entries or match a x-custom- format:
- Authorization
- dd-api-key
- content-type
Add all necessary headers and values, and then click Test connection. When the connection is successful, you can click Add.

At this point, your SIEM tool should confirm the connection and start receiving data from NinjaOne.

Figure 5: Webhook connection test example

Webhook management

To pause or cancel the webhook connection to your SIEM, you can select one or more webhooks and click Disable. The Disabled status means the webhook is not actively sending any events to the destination.

To restart the connection, select the webhook and click Enable. You can only restore one connection at a time.

Deleting a webhook is irreversible, so we recommend using the Disable function unless the connection was made in error.

Troubleshooting webhook status errors

Your webhook will appear on the page showing its current status, which can be either Enabled, Disabled, or Error. If you have an Error status, move your mouse cursor over the text to use the tooltip, which will provide a brief summary of the issue for troubleshooting. Errors may be caused by rate limiting, invalid authentication, or malformed payload.

View organizations for your webhook

After you add the webhook, you can view high-level details from the Webhooks tab in the SIEM Exporter application. The table will show the number of organizations that have access to the webhook. Click the number to open the Organizations dialog, where you can select the organization name to navigate to its dashboard.

Figure 8: View organizations with access to a webhook

Configure SIEM system activities

We have introduced several system activities for the SIEM Exporter so you can notify technicians, update notification channels, or create tickets for certain events. To learn more about system activity configuration, refer to NinjaOne Endpoint Management: Notification Channels and Alerts in the Dojo.