Skip to main content
The Threat Intel webhook monitor accepts structured JSON payloads describing a vulnerability or a supply chain threat — for example a scanner posting a CVE finding or a malicious-package detection. Clarion turns each into an issue and triages it with AI agents.
Estimated time: 5 minutes. You will need a Clarion workspace and a sender that can sign requests with HMAC-SHA256.

​
Step 1 — Create the monitor

  1. In Clarion, go to Settings > Integrations
  2. Find Threat Intel and click Add Monitor
  3. Pick the Threat Intel monitor type and give it a name
  4. Click Create
Clarion generates a webhook URL and a signing secret. Copy both right away.
Copy the signing secret immediately — it is only displayed once. You can regenerate it later from the monitor’s Configure page, but you cannot view the current value.

​
Step 2 — Send signed events

Point your sender at the webhook URL with an HTTP POST. The body must be a JSON object up to 100 KB, signed with HMAC-SHA256.
  • Compute HMAC-SHA256(raw_request_body, signing_secret) and send the hex digest in the x-signature header.
  • The payload must contain a vulnerability object, a threat object, or both. Either one alone is enough.
vulnerability fields threat fields Any extra fields you include are preserved on the issue for the triage agent to reason about — nothing is dropped.
A successful request is accepted asynchronously (HTTP 202); Clarion validates the payload and opens the issue on its worker. The issue title is derived from the payload — for example CVE-2021-23337: Vulnerability in lodash@4.17.20 or Supply chain threat: typosquat (left-pad@1.0.0).

​
Severity mapping

The issue severity comes from the payload’s severity string (the vulnerability value takes precedence over the threat value):

​
What happens next

Once configured, Clarion will automatically:
  • Accept signed payloads at the monitor’s webhook URL
  • Open an issue for each vulnerability or threat, with the severity mapped above
  • Triage incoming issues with AI agents and surface actionable insights
Clarion ships a built-in Threat Intelligence agent that triages advisories and correlates them to your environment. Assign it to this monitor to automate the first pass.