SIEM Integration

Elasticsearch

To set up Real-Time notifications with an Elasticsearch instance, select Elasticsearch Notification driver on the dropdown box and click on the add button.

Fields marked with * are mandatory

Configure the following parameters according to your elasticsearch set up:

• Title: Name of this integration
• Uri: Network endpoint of your elasticsearch instance (must be publicly available)
• Accept All Certificates: turn-on to allow self-signed certificates
• Username/Password: client authorization to the elastic search instance
• Request Timeout (milliseconds): maximum amount of time waiting for the request to be completed
• Max. Number of Retries: number of times the service attempts to deliver the Real-Time Notification once the first attempt fails
• Elasticsearch Index: name of the elasticsearch index where your notifications will be grouped
• Elasticsearch Type: name of the elasticsearch type

When you are done, click on the create button to validate and store the configured elasticsearch integration.

At any time, you can make changes or remove the elasticsearch integrations.

Webhook

To set up Real-Time notifications with a Webhook, select Webhook Notification driver on the dropdown box and click on the add button.

Fields marked with * are mandatory

Configure the following parameters according to your SIEM (should be capable of receiving http(s) requests):

• Title: Name of this integration
• Endpoint to send a POST Request: Network endpoint of your http(s) server instance (must be publicly available)
• Basic Authentication Username/Password: client authorization to the http(s) server
• Support Self Signed Certificates: turn-on to allow self-signed certificates
• Max. Number of Retries: number of times the service attempts to deliver the Real-Time Notification once the first attempt fails

When you are done, click on the create button to validate and store the configured webhook integration.

At any time, you can make changes or remove the webhook integrations.

Webhook request body

Your endpoint receives an HTTP POST with Content-Type: application/json. The body is a single JSON object.

Top-level fields

Field	Description
message	Notification content and metadata (see below).
client, externId, uuid, driverInstance	Internal fields. Jscrambler may use them for debugging and operational purposes; you do not need to rely on their meaning for normal integrations.
timestamp	Unix time in milliseconds when Jscrambler delivered this notification to your endpoint (server-side). This is not the same as message.body["1"].

message object

Field	Description
title	Notification title (e.g. Real time notification).
description	Human-readable text with a brief description of the problem.
body	Object whose keys are numeric strings ("0", "1", … in JSON). Values are collected on the client side in the protected application (see payload fields below).
clientIp	Approximate IP address associated with the client-side environment when the notification was sent.
referer	HTTP Referer header from that request, if present; otherwise null.
protectionId	Present when the notification is tied to a specific protection in your Jscrambler configuration.
customLabels	Optional labels you configured for the protection, when defined; arbitrary key/value map for your own tagging.

protectionId and customLabels appear in webhook payloads starting with Jscrambler 8.6.

Payload fields in message.body

These keys (0–8) are produced by the client-side application. Omitted keys are normal when the runtime has no value (for example, Node typically has no page URL; browsers often have no process version or argv).

Key	Name (logical)	Meaning
0	code	Technical value Jscrambler uses for debugging and support; it has no particular meaning you need to rely on for day-to-day use.
1	timestamp	Client-side event time as milliseconds since Unix epoch (when the client-side application built the payload).
2	timezoneOffset	Local timezone offset in minutes (same semantics as JavaScript Date.prototype.getTimezoneOffset()).
3	platform	process.platform in Node.js, or navigator.platform in browsers when available.
4	userAgent	navigator.userAgent when available.
5	href	Current page URL (location.href) when running in a browser context.
6	nodeVersion	Node.js process.version when process is available.
7	argv	Node.js process.argv when process is available.
8	product	navigator.product, or a NativeScript-style hint when applicable; otherwise may be absent.

Example (illustrative; keys depend on environment):

{
  "message": {
    "title": "Real time notification",
    "description": "We've detected that your application ran after the allowed time period",
    "body": {
      "0": "j-002-00004",
      "1": 1775138344451,
      "2": -60,
      "3": "Linux x86_64",
      "4": "Node.js/22",
      "6": "v22.21.1",
      "7": ["/home/user/bin/node", "/home/user/app/script.js"]
    },
    "clientIp": "172.30.0.3",
    "referer": null,
    "protectionId": "<protectionId>",
    "customLabels": {
      "env": "prod"
    }
  },
  "client": "<clientId>",
  "externId": "<externId>",
  "uuid": "<uuid>",
  "driverInstance": "<driverInstanceId>",
  "timestamp": 1775138345176
}