UpGuard

The following tutorial demonstrates how to send your logs to Coralogix using UpGuard. Follow this five-step guide for each notification that you would like to send us.

UpGuard uses webhooks to send notifications when an event happens in your UpGuard account. This could be when an identity breach or data leak is detected, the score of a watched vendor drops below a certain threshold, or when a user requests access to your shared profile.

Configuration

STEP 1. Create Integration.

Login to your Upguard account.
Select Settings in your left-hand sidebar.

Settings UpGuard Coralogix

Click on the Integrations tab.

Integrations UpGuard Coralogix

Click + New Integration.

New Integration UpGuard Coralogix

Select Webhook.

Webhook UpGuard Coralogix

STEP 2. Select Triggers

Select from a wide-range of pre-defined triggers to use as part of this integration. Examples include:
- 'When my company's score drops below 600'
- 'When a domain or IP's score drops below 600'
- 'When a new identity breach is detected'
- 'When a new identity breach for a VIP email is detected'
Enable a trigger by clicking on the associated pill, which slides to the right.

Triggers UpGuard Triggers

Click Confirm and next.

STEP 3. Name and Destination

Provide the webhook URL corresponding to the Coralogix cluster URL associated with the domain and region where your data is stored.

Coralogix Cluster URL	API Endpoint
.com	https://api.coralogix.com
.us	https://api.coralogix.us
.in	https://api.app.coralogix.in
.app.eu2.coralogix.com	https://api.eu2.coralogix.com
.app.coralogixsg.com	https://api.coralogixsg.com

For example, if your Coralogix data is hosted in India, your webhook URL should appear as https://api.app.coralogix.in/api/v1/logs.

Configure the HTTP Header values by inputting Content-Type: application/json. As webhook by default uses POST method to send requests, there is no need to define the method.

Name and destination UpGuard Coralogix

Example:

Click Confirm and next.

STEP 4. Define Payload Structure

For each trigger, UpGuard provides a default payload template as in the example below.

Example payload data UpGuard Coralogix

Modify the payload template to comply with the Coralogix structure.

POST Body

Schema Endpoint Details
Webhook URL	https://api./api/v1/logs
Content-Type	application/json

Required	Property Name	Property Type	Note
Yes	privateKey	UUID
Yes	applicationName	string	usually used to separate environments
Yes	subsystemName	string	usually used to separate components
	computerName	string
Yes	logEntries	array of logs

Log

Required	Property Name	Property Type	Notes
Yes	timestamp	number	UTC milliseconds since 1970 (supports sub millisecond via a floating point)
Yes	severity	number	1 – Debug, 2 – Verbose, 3 – Info, 4 – Warn, 5 – Error, 6 – Critical
Yes	text	string

Wrap the payload template in JSON as follows. You will need to input your Coralogix Send-Your-Data API key, application and subsystem names, and computer name.

{
   "privateKey": "<Coralogix send your data api-key>",
   "applicationName": "<application name>",
   "subsystemName": "<subsytem name>",
   "computerName": "<computer name>",
   "logEntries": [
     {
       "severity": <default severity of event 1-6>,
       "text": {
           "notification": {
           }
        }
     }
   ]
}

The following is an example of a Coralogix-compatible payload template.

{ 
"privateKey": "xxxxxxx-xxxxxx-xxxxxx-xxxxxxx",
   "applicationName": "upguard",
   "subsystemName": "upguard",
   "computerName": "upguard01",
   "logEntries": [
     {
       "severity": 4,
       "text": {
   "notification": {
     "id": {{ notification.id }},
     "type": "{{ notification.type }}",
     "description": "{{ notification.description }}",
     "occurredAt": "{{ notification.occurredAt }}",
     "context":     {
       "PrevScore": {{ notification.context.PrevScore }},
       "PrevScoreOn": "{{ notification.context.PrevScoreOn }}",
       "Threshold": {{ notification.context.Threshold }},
       "LatestScore": {{ notification.context.LatestScore }},
       "LatestScoreOn": "{{ notification.context.LatestScoreOn }}"
     }
   }
 }
     }
   ]
 }