Notifications
OrbitalCyber sends two kinds of notifications: What Who gets it Channels Where you set it up Scan finished The person who asked to be notified when they set up the scan or schedule Email and Pushover, following that person's notification preferences Notify me in the scan form, plus Notifications Honeypot alerts The recipients your organisation (or personal account) adds Email and webhooks Honeypots > Alerts Your notification preferences Notification preferences are personal. Each user sets their own under Notifications, and they apply only to messages sent to that user. Email goes to the address on your account. Choose channels by category The table lists each category with an Email and a Pushover checkbox. Scan notifications belong to App notifications. Email is on by default. Pushover is off by default. Transactional email can't be turned off. The Pushover checkboxes are available only after you save both Pushover values (see below). Select Save after making changes. Set up Pushover Pushover sends notifications to your phone. You need both of these: Application token. Create an application on your Pushover apps page and copy its token. User key. Copy it from your Pushover account dashboard. Enter both values under Pushover credentials, select Save, and then tick the Pushover checkboxes for the categories you want. Test your channels Under Test notifications: Send test email sends to the address on your account. Send test push uses your saved Pushover credentials. Changes you haven't saved aren't tested. Scan notifications When you set up a scan or a schedule, choose an option under Notify me: No When it finishes Only if it finds high or critical issues, or fails The notification goes to the person who set it, through that person's preferences. It isn't sent to anyone else. If you've left the organisation, it isn't sent. The message includes: the scan's name the result: finished, failed or was cancelled, with a note explaining a failure or a scan that found nothing the targets (the first 10) the number of hosts found the number of critical, high, medium and low vulnerabilities found The message contains a link to the scan list. All other details stay behind sign-in. See Scans. Honeypot alerts Honeypot alerts are set up once for your whole organisation (or personal account), under Honeypots > Alerts. They don't use the personal preferences above. Only people who manage sensors can change them. When an alert is sent, how email recipients confirm their address, and the cooldown are all described in Honeypots. Email. Any address can be added. Each address must confirm through a link first, and every email has a link to stop the alerts. Email alerts are included in every plan. Webhooks. Whether you can use webhook alerts depends on your plan (see Subscription). Honeypot webhooks Add a webhook Go to Honeypots > Alerts > Webhooks. Enter an https:// URL on a public address and select Add. Copy the signing secret (it starts with whsec_). It isn't shown again. If you lose it, remove the webhook and add it again. Select the share icon to send a test alert. Each webhook shows the time and result of its last delivery. The request We send a POST with a JSON body and these headers: Header Value Content-Type application/json User-Agent OrbitalCyber-Honeypot-Alerts/1 X-Orbital-Event honeypot.alert X-Orbital-Signature sha256= followed by the hex HMAC-SHA256 of the raw body, keyed with the signing secret The body's type is honeypot.alert for real alerts and honeypot.test for tests: services holds the service keys: cowrie (SSH / Telnet), dionaea (Windows & databases), heralding (credential catcher), mailoney (mail), conpot (industrial), redishoneypot (Redis), elasticpot (Elasticsearch), adbhoney (Android debug) and h0neytr4p (web). dst_port, username, password and command appear only when they're known. Attackers from a custom honeypot have "custom": true, services: ["custom"], the custom honeypot's ID and name in sensor_id and sensor_name…
OrbitalCyber documentation