Event Notification

Payload

{
  "type": "RANSOMWARE_DETECTED_IN_SNAPSHOT",
  "arguments": {
    "snapshotArguments": {
      "resourceProviderId": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef0",
      "resourceName": "prod-db",
      "snapshotId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
      "securityScan": {
        "snapshotId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
        "dateCreated": {
          "seconds": 1709528767
        },
        "conclusion": 2,
        "results": [
          {
            "score": 0.92,
            "path": "/var/lib/data/encrypted.bin",
            "type": 1
          }
        ],
        "confidence_score": 0.92,
        "detector_type": 2,
        "risk_level": 4,
        "total_results_count": 1
      },
      "resourceType": "AWS_EC2"
    }
  },
  "id": "5f0c4d3e-6a1b-4c2d-9e8f-0a1b2c3d4e5f",
  "projectId": "7b1d4f2a-3c5e-4a6b-8d9e-1f2a3b4c5d6e",
  "timestamp": "2024-03-04T05:06:07Z"
}

Reports an event notification.

Eon sends this request when an event you’re subscribed to occurs, which you configure with notification policies. For more information, see About Notification Policies and Manage Notification Policies for Webhooks.

For details about handling webhooks, see Webhooks.

Payload

The payload of this webhook request is an object.

BACKUP_JOB_FAILEDobjectRequired

Notification of a failed backup job.

OR

BACKUP_JOB_SKIPPEDobjectRequired

Notification of a skipped backup job.

OR

BACKUP_JOB_REJECTEDobjectRequired

Notification of a rejected backup job.

OR

BACKUP_JOB_SUCCEEDEDobjectRequired

Notification of a successful backup job.

OR

BACKUP_JOB_PARTIALobjectRequired

Notification of a partially successful backup job.

OR

RESTORE_JOB_SUCCEEDEDobjectRequired

Notification of a successful restore job.

OR

RESTORE_JOB_FAILEDobjectRequired

Notification of a failed restore job.

OR

RESTORE_JOB_REJECTEDobjectRequired

Notification of a rejected restore job.

OR

CLASSIFICATION_JOB_FAILEDobjectRequired

Notification of a failed classification job.

OR

CLASSIFICATION_JOB_SKIPPEDobjectRequired

Notification of a skipped classification job.

OR

CLASSIFICATION_JOB_REJECTEDobjectRequired

Notification of a rejected classification job.

OR

BACKUP_POLICY_APPLIEDobjectRequired

Notification of a policy applied to or unapplied from a resource.

OR

BACKUP_POLICY_UNAPPLIEDobjectRequired

Notification of a policy applied to or unapplied from a resource.

OR

CLASSIFICATION_POLICY_APPLIEDobjectRequired

Notification of a policy applied to or unapplied from a resource.

OR

CLASSIFICATION_POLICY_UNAPPLIEDobjectRequired

Notification of a policy applied to or unapplied from a resource.

OR

BACKUP_POLICY_CREATEDobjectRequired

Notification of a created, updated, or deleted policy.

OR

BACKUP_POLICY_UPDATEDobjectRequired

Notification of a created, updated, or deleted policy.

OR

BACKUP_POLICY_DELETEDobjectRequired

Notification of a created, updated, or deleted policy.

OR

CLASSIFICATION_POLICY_CREATEDobjectRequired

Notification of a created, updated, or deleted policy.

OR

CLASSIFICATION_POLICY_UPDATEDobjectRequired

Notification of a created, updated, or deleted policy.

OR

CLASSIFICATION_POLICY_DELETEDobjectRequired

Notification of a created, updated, or deleted policy.

OR

BACKUP_VAULT_CREATEDobjectRequired

Notification of a created or deleted vault.

OR

BACKUP_VAULT_DELETEDobjectRequired

Notification of a created or deleted vault.

OR

CLOUD_ACCOUNT_CREATEDobjectRequired

Notification of a cloud account change.

OR

CLOUD_ACCOUNT_UPDATEDobjectRequired

Notification of a cloud account change.

OR

CLOUD_ACCOUNT_DELETEDobjectRequired

Notification of a cloud account change.

OR

CLOUD_ACCOUNT_DEACTIVATEDobjectRequired

Notification of a cloud account change.

OR

CLOUD_ACCOUNT_ACTIVATEDobjectRequired

Notification of a cloud account change.

OR

CLOUD_ACCOUNT_ACCESS_LOSTobjectRequired

Notification of a cloud account change.

OR

RANSOMWARE_DETECTED_IN_RESOURCEobjectRequired

Notification of a security finding change on a resource.

OR

RANSOMWARE_INFECTION_REMEDIATEDobjectRequired

Notification of a security finding change on a resource.

OR

RESOURCE_EXCLUDED_FROM_RANSOMWARE_DETECTIONobjectRequired

Notification of a security finding change on a resource.

OR

RANSOMWARE_DETECTION_EXCLUSION_CANCELEDobjectRequired

Notification of a security finding change on a resource.

OR

MALWARE_REMEDIATEDobjectRequired

Notification of a security finding change on a resource.

OR

DATA_ANOMALY_REMEDIATEDobjectRequired

Notification of a security finding change on a resource.

OR

AI_DATA_RISK_REMEDIATEDobjectRequired

Notification of a security finding change on a resource.

OR

DATA_EXPOSURE_RISK_REMEDIATEDobjectRequired

Notification of a security finding change on a resource.

OR

RANSOMWARE_DETECTED_IN_SNAPSHOTobjectRequired

Notification of security scan finding a risk in a snapshot.

OR

MALWARE_DETECTED_IN_SNAPSHOTobjectRequired

Notification of security scan finding a risk in a snapshot.

OR

DATA_ANOMALY_DETECTED_IN_SNAPSHOTobjectRequired

Notification of security scan finding a risk in a snapshot.

OR

AI_DATA_RISK_DETECTED_IN_SNAPSHOTobjectRequired

Notification of security scan finding a risk in a snapshot.

OR

DATA_EXPOSURE_RISK_DETECTED_IN_SNAPSHOTobjectRequired

Notification of security scan finding a risk in a snapshot.

OR

SNAPSHOT_USER_PROTECTEDobjectRequired

Notification of a user protecting or unprotecting a snapshot.

OR

SNAPSHOT_USER_UNPROTECTEDobjectRequired

Notification of a user protecting or unprotecting a snapshot.

OR

SNAPSHOT_INCLUDES_ACCESS_DENIED_ITEMSobjectRequired

Notification of a snapshot with items that Eon was denied access to.

OR

HIGH_SEVERITY_VIOLATIONS_DETECTED_ON_RESOURCESobjectRequired

Notification of a policy violation detected or resolved on a resource.

OR

MEDIUM_SEVERITY_VIOLATIONS_DETECTED_ON_RESOURCESobjectRequired

Notification of a policy violation detected or resolved on a resource.

OR

LOW_SEVERITY_VIOLATIONS_DETECTED_ON_RESOURCESobjectRequired

Notification of a policy violation detected or resolved on a resource.

OR

VIOLATIONS_RESOLVED_ON_RESOURCESobjectRequired

Notification of a policy violation detected or resolved on a resource.

OR

ISSUE_MUTED_ON_RESOURCEobjectRequired

Notification of a muted or unmuted resource issue.

OR

ISSUE_UNMUTED_ON_RESOURCEobjectRequired

Notification of a muted or unmuted resource issue.

OR

JOB_METRICS_REPORT_FAILEDobjectRequired

Notification of a failed job metrics report.

OR

NOTIFICATION_TARGET_CREATEDobjectRequired

Notification of a notification policy change.

OR

NOTIFICATION_TARGET_UPDATEDobjectRequired

Notification of a notification policy change.

OR

NOTIFICATION_TARGET_DELETEDobjectRequired

Notification of a notification policy change.

OR

NOTIFICATION_TARGET_ENABLEDobjectRequired

Notification of a notification policy change.

OR

NOTIFICATION_TARGET_DISABLEDobjectRequired

Notification of a notification policy change.

OR

CREDITS_USAGE_THRESHOLD_75objectRequired

Notification of a crossed threshold of credit usage.

OR

CREDITS_USAGE_THRESHOLD_90objectRequired

Notification of a crossed threshold of credit usage.

OR

CREDITS_USAGE_THRESHOLD_95objectRequired

Notification of a crossed threshold of credit usage.

OR

CREDITS_MONTHLY_USAGE_80objectRequired

Notification of a crossed threshold of monthly credit usage.

OR

CREDITS_MONTHLY_USAGE_90objectRequired

Notification of a crossed threshold of monthly credit usage.

OR

CREDITS_MONTHLY_USAGE_100objectRequired

Notification of a crossed threshold of monthly credit usage.

OR

MPA_REQUEST_PENDING_APPROVALobjectRequired

Notification of a state change of an action approval request.

OR

MPA_REQUEST_EXECUTEDobjectRequired

Notification of a state change of an action approval request.

OR

MPA_REQUEST_EXPIREDobjectRequired

Notification of a state change of an action approval request.

OR

MPA_REQUEST_CANCELLEDobjectRequired

Notification of a state change of an action approval request.

OR

MPA_REQUEST_APPROVEDobjectRequired

Notification of a review of an action approval request.

OR

MPA_REQUEST_DENIEDobjectRequired

Notification of a review of an action approval request.

OR

MPA_REQUEST_PARTIALLY_APPROVEDobjectRequired

Notification of a review of an action approval request.

Response

2XX

Received.

Expected 2xx response code. Any other response code is taken to mean the delivery failed. Response body is ignored.