Skip to content

Handle comment-on-alert payloads in webhook dispatch#21

Open
Acsigen wants to merge 1 commit into
dfir-iris:masterfrom
fort-cyber:master
Open

Handle comment-on-alert payloads in webhook dispatch#21
Acsigen wants to merge 1 commit into
dfir-iris:masterfrom
fort-cyber:master

Conversation

@Acsigen

@Acsigen Acsigen commented Jun 25, 2026

Copy link
Copy Markdown

The 'alert' hook assumed data[0] was always an alert (object or dict) and ran it through AlertSchema. Comment-on-alert payloads are a dict carrying a nested 'alert' and a 'comment', which broke the schema dump and produced a bad object_url.

Detect that shape via the 'comment' key: build object_url from the nested data[0]['alert']['alert_id'] and pass the raw payload through instead of dumping it with AlertSchema.

The 'alert' hook assumed data[0] was always an alert (object or dict) and
ran it through AlertSchema. Comment-on-alert payloads are a dict carrying a
nested 'alert' and a 'comment', which broke the schema dump and produced a
bad object_url.

Detect that shape via the 'comment' key: build object_url from the nested
data[0]['alert']['alert_id'] and pass the raw payload through instead of
dumping it with AlertSchema.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant