Alerts Not Arriving¶

If alerts from your SIEM aren't appearing in Parapet Security, follow this troubleshooting guide.

Quick Checks¶

1. A common mistake is including a trailing slash. The URL should end with your tenant ID, not /.

Step-by-Step Diagnosis¶

Step 1: Verify Webhook URL¶

1. Go to Settings → Service Tokens
2. Compare the webhook URL with your SIEM configuration
3. URL format should be:

   https://webhook-us.parapetsecurity.com/webhook/{tenant-id}
   

Step 2: Verify Token¶

1. In Settings → Service Tokens, check:
2. Token exists
3. Token isn't expired

4. Token hasn't been revoked

5. Try generating a new token and updating your SIEM

Step 3: Test Connectivity¶

From your SIEM server, test the connection:

curl -X POST https://webhook-us.parapetsecurity.com/webhook/{tenant-id} \
  -H "Authorization: Bearer pst_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"source": "test", "message": "connectivity test"}'

Expected response:

{
  "status": "accepted",
  "alert_id": "550e8400-e29b-41d4-a716-446655440000"
}

If you get an error, see the table below.

Step 4: Check SIEM Logs¶

Look for webhook delivery logs in your SIEM:

sudo tail -f /var/ossec/logs/integrations.log

index=_internal source=*scheduler.log* webhook

Step 5: Verify SIEM Is Generating Alerts¶

Ensure alerts are being generated in your SIEM before the webhook:

sudo tail -f /var/ossec/logs/alerts/alerts.json

Common Error Responses¶

Firewall Configuration¶

Ensure your SIEM can reach these endpoints:

Check Your Plan Limits¶

Free and Starter plans have daily alert limits:

View your current usage: Settings → Account & Billing

Common Scenarios¶

Alerts Worked Before, Now Stopped¶

1. Token expired - Check token expiry, regenerate if needed
2. Plan limit reached - Check usage in billing
3. SIEM updated - Check if SIEM update changed webhook config
4. Network change - Firewall rules may have changed

Some Alerts Arrive, Others Don't¶

1. Severity threshold - Check SIEM is sending all severities
2. Rate limiting - High volume may trigger limits
3. Filtering rules - Check SIEM alert forwarding rules

Test Alert Works, Real Alerts Don't¶

1. Alert format - Your test may differ from real alerts
2. Integration script - Check for errors in custom scripts
3. Alert rules - Ensure SIEM rules are triggering

Advanced Diagnostics¶

Check DNS Resolution¶

nslookup webhook-us.parapetsecurity.com

Should return valid IPs.

Check TLS Connectivity¶

openssl s_client -connect webhook-us.parapetsecurity.com:443

Should show certificate chain and "Verify return code: 0 (ok)".

Check Response Headers¶

curl -v -X POST https://webhook-us.parapetsecurity.com/webhook/{tenant-id} \
  -H "Authorization: Bearer pst_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"test": true}' 2>&1 | grep -E "^< "

Look for unusual headers or error messages.

Still Having Issues?¶

1. Enable debug logging in your SIEM
2. Capture the full HTTP request and response
3. Send the details to support@parapetsecurity.com

Include:

• Your tenant ID (first 8 characters only)
• SIEM platform and version
• HTTP response code and body
• Timestamp of the issue