Webhooks and SIEM

AgentID can send security events of an AI system to HTTPS endpoints, for example a SIEM collector.

Configure a webhook

Open the AI system's Integration tab and click Open SIEM Settings under SIEM & Event Streaming. Add a webhook with:

• Target URL: a public HTTPS endpoint,
• Secret: the shared secret used to sign deliveries,
• Alerts: send security_alert events,
• Blocks: send security_block and security_policy_violation events,
• Active: turn delivery on or off.

Delivery

Each event is sent as a JSON POST with these headers:

{
  "type": "agentid.security_event",
  "event_id": "285d12c7-7f10-40f2-b50b-e61eb8cfd970",
  "system_id": "cf84f936-95bc-45a4-bf98-9a1a16bf29c9",
  "event_type": "security_block",
  "severity": "error",
  "timestamp": "2026-10-14T09:30:00.000Z",
  "model": "gpt-4o-mini",
  "system_version": 3,
  "input_hash": "9f2c...",
  "output_hash": "41ab...",
  "input_tokens": 33,
  "output_tokens": 12,
  "cost_usd": 0.0001,
  "metadata": {}
}

input_hash and output_hash are SHA-256 hashes; the prompt and answer text are not sent. For systems that block personal information, the payload is redacted before delivery. A delivery times out after 7.5 seconds.

Verify the signature

Compute the HMAC over the exact raw body you received, before parsing it:

import { createHmac, timingSafeEqual } from "node:crypto";

export function isValidAgentIdSignature(rawBody: string, signature: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(signature, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

import hashlib
import hmac

def is_valid_agentid_signature(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Answer with a 2xx status. Use X-AgentID-Event-ID to ignore duplicates.

Other alert channels

For human notifications, set a Slack incoming webhook and an alert e-mail in Guardrails → Notification Channels.