The following tutorial demonstrates how to send your logs to Coralogix using [UpGuard](https://www.upguard.com/). Follow this five-step guide for each notification that you would like to send us.

[UpGuard](https://coralogix.com/integrations/upguard/) uses webhooks to send notifications when an event happens in your UpGuard account. This could be when an identity breach or data leak is detected, the score of a watched vendor drops below a certain threshold, or when a user requests access to your shared profile.

## Configuration

**STEP 1**. **Create Integration.**

- Login to your Upguard account.

- Select **Settings** in your left-hand sidebar.

- Click on the **Integrations** tab.

- Click **+ New Integration**.

- Select **Webhook**.

**STEP 2. Select Triggers**

- Select from a wide-range of pre-defined triggers to use as part of this integration. Examples include:

  - 'When my company's score drops below 600'
  - 'When a domain or IP's score drops below 600'
  - 'When a new identity breach is detected'
  - 'When a new identity breach for a VIP email is detected'

- Enable a trigger by clicking on the associated pill, which slides to the right.

- Click **Confirm and next**.

**STEP 3. Name and Destination**

- Provide the webhook URL corresponding to the Coralogix cluster URL associated with the [domain and region](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain/index.md) where your data is stored.

| Coralogix Cluster URL  | API Endpoint                  |
| ---------------------- | ----------------------------- |
| .com                   | https://api.eu1.coralogix.com |
| .us                    | https://api.us1.coralogix.com |
| .in                    | https://api.ap1.coralogix.com |
| .app.eu2.coralogix.com | https://api.eu2.coralogix.com |
| .app.ap2.coralogix.com | https://api.ap2.coralogix.com |

| Schema Endpoint Details |                                    |
| ----------------------- | ---------------------------------- |
| Webhook URL             | https://ingress.\[[DOMAIN_VALUE]\] |
| Content-Type            | application/json                   |

For **example**, if your Coralogix data is hosted in India, your webhook URL should appear as **https://ingress.ap1.coralogix.com**.

- Configure the **HTTP Header** values by inputting **Content-Type: application/json**. As webhook by default uses POST method to send requests, there is no need to define the method.

Example:

- Click **Confirm and next**.

**STEP 4. Define Payload Structure**

- For each trigger, UpGuard provides a default payload template as in the example below.

- Modify the payload template to comply with the Coralogix structure.

**POST Body**

| Required | Property Name   | Property Type | Note                                  |
| -------- | --------------- | ------------- | ------------------------------------- |
| Yes      | privateKey      | UUID          |                                       |
| Yes      | applicationName | string        | usually used to separate environments |
| Yes      | subsystemName   | string        | usually used to separate components   |
|          | computerName    | string        |                                       |
| Yes      | logEntries      | array of logs |                                       |

**Log**

| Required | Property Name | Property Type | Notes                                                                       |
| -------- | ------------- | ------------- | --------------------------------------------------------------------------- |
| Yes      | timestamp     | number        | UTC milliseconds since 1970 (supports sub millisecond via a floating point) |
| Yes      | severity      | number        | 1 – Debug, 2 – Verbose, 3 – Info, 4 – Warn, 5 – Error, 6 – Critical         |
| Yes      | text          | string        |                                                                             |

- Wrap the payload template in JSON as follows. You will need to input your Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key/index.md), [application and subsystem](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names/index.md) names, and computer name.

```json
{
   "privateKey": "<Coralogix send your data api-key>",
   "applicationName": "<application name>",
   "subsystemName": "<subsytem name>",
   "computerName": "<computer name>",
   "logEntries": [
     {
       "severity": <default severity of event 1-6>,
       "text": {
           "notification": {
           }
        }
     }
   ]
}
```

- The following is an **example** of a Coralogix-compatible payload template.

```json
{ 
"privateKey": "xxxxxxx-xxxxxx-xxxxxx-xxxxxxx",
   "applicationName": "upguard",
   "subsystemName": "upguard",
   "computerName": "upguard01",
   "logEntries": [
     {
       "severity": 4,
       "text": {
   "notification": {
     "id": {{ notification.id }},
     "type": "{{ notification.type }}",
     "description": "{{ notification.description }}",
     "occurredAt": "{{ notification.occurredAt }}",
     "context":     {
       "PrevScore": {{ notification.context.PrevScore }},
       "PrevScoreOn": "{{ notification.context.PrevScoreOn }}",
       "Threshold": {{ notification.context.Threshold }},
       "LatestScore": {{ notification.context.LatestScore }},
       "LatestScoreOn": "{{ notification.context.LatestScoreOn }}"
     }
   }
 }
     }
   ]
 }
```

- Validate that your webhook is working properly by clicking **Send test message**. The value '200 OK' should appear as the **Response**.

Example:

- Validate that Coralogix has received the test notification by searching the logs in your Coralogix dashboard.

- Click **Confirm and next**.

**STEP 5. Enable the Integration**

- Click the toggle to enable the integration and click **Finish**.

## A**dditional Resources**

| UpGuard | [Webhook documentation for advanced modification of Webhook Payload](https://help.upguard.com/en/articles/4205928-how-to-integrate-upguard-with-other-services-using-webhooks) |
| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|         |                                                                                                                                                                                |

## Additional resources

|                     |                                                                                             |
| ------------------- | ------------------------------------------------------------------------------------------- |
| Coralogix Endpoints | [Coralogix Endpoints](https://coralogix.com/docs/integrations/coralogix-endpoints/index.md) |

## **Support**

**Need help?**

Our world-class customer success team is available 24/7 to walk you through your setup and answer any questions that may come up.

Feel free to reach out to us **via our in-app chat** or by sending us an email at [support@coralogix.com](mailto:support@coralogix.com).