|
|
|
|
@@ -1,19 +1,23 @@
|
|
|
|
|
# Stream Network Activity to a Generic HTTP Endpoint
|
|
|
|
|
|
|
|
|
|
The Generic HTTP integration streams your NetBird audit and traffic events to any HTTP or HTTPS endpoint you control. It is the most flexible of the event streaming options, and it is the foundation the [SentinelOne Data Lake](/manage/activity/event-streaming/sentinelone-data-lake) and [Wazuh](/manage/activity/event-streaming/wazuh) guides build on. Use it for custom SIEMs, log management tools like Grafana Loki, or any service that accepts POST requests.
|
|
|
|
|
The Generic HTTP integration streams your NetBird audit and traffic events to any HTTPS endpoint you control. It is the most flexible of the event streaming options, and it is the foundation the [SentinelOne Data Lake](/manage/activity/event-streaming/sentinelone-data-lake) and [Wazuh](/manage/activity/event-streaming/wazuh) guides build on. Use it for custom SIEMs, log management tools like Grafana Loki, or any service that accepts POST requests.
|
|
|
|
|
|
|
|
|
|
For every event, NetBird sends a POST request to the endpoint you configure. You control the request headers and, optionally, the shape of the body.
|
|
|
|
|
|
|
|
|
|
<Note>
|
|
|
|
|
Event streaming is available in NetBird Cloud under the [Business plan](https://www.netbird.io/pricing?utm_source=docs&utm_content=event-streaming) and in licensed self-hosted Enterprise deployments. The open-source management server does not serve the event streaming API, so the integration cards stay locked there.
|
|
|
|
|
Event streaming is available in NetBird Cloud under the [Business plan](https://www.netbird.io/pricing?utm_source=docs&utm_content=event-streaming) and in licensed self-hosted Enterprise deployments. The open source management server does not serve the event streaming API, so the integration cards stay locked there.
|
|
|
|
|
</Note>
|
|
|
|
|
|
|
|
|
|
## Prerequisites
|
|
|
|
|
|
|
|
|
|
- An HTTP or HTTPS endpoint that accepts POST requests and is reachable from NetBird. On NetBird Cloud that means it has to be publicly reachable. The dashboard's URL field accepts `localhost` and private IPv4 addresses, but NetBird Cloud cannot deliver to them.
|
|
|
|
|
- An HTTPS endpoint that accepts POST requests and is reachable from NetBird. On NetBird Cloud that means it has to be publicly reachable. The dashboard's URL field accepts `localhost` and private IPv4 addresses, but NetBird Cloud cannot deliver to them.
|
|
|
|
|
- Any credentials your endpoint requires, such as an API key, a bearer token, or a username and password.
|
|
|
|
|
- An account role that grants the `event_streaming` permission. Without it, the Generic HTTP card is read-only.
|
|
|
|
|
|
|
|
|
|
<Warning>
|
|
|
|
|
Use `https://` for the endpoint. Streamed events carry your audit and traffic data, and the credentials you configure are sent on every request in an `Authorization` or custom header. Over plain `http://` both travel in cleartext and can be read or modified in transit. The dashboard's URL validator does not reject an `http://` address, so nothing stops you from saving one; treat that as a gap in validation rather than as a supported configuration.
|
|
|
|
|
</Warning>
|
|
|
|
|
|
|
|
|
|
<Note>
|
|
|
|
|
Only one event streaming integration can be enabled at a time. If Datadog, Amazon S3, or Amazon Data Firehose is already enabled, the Generic HTTP card is dimmed and cannot be turned on until you disable the other one.
|
|
|
|
|
</Note>
|
|
|
|
|
@@ -32,7 +36,7 @@ This tab holds the endpoint address and the authentication method.
|
|
|
|
|
<img src="/docs-static/img/manage/activity/event-streaming/generic-http/general-config.png" alt="Generic HTTP General Configuration" className="imagewrapper-big"/>
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
- **Enter your Endpoint URL**: the full HTTP or HTTPS URL that receives the POST requests. This field is required. The label reads `Endpoint URL` when you reopen an existing integration. Invalid input shows `Please enter a valid url, e.g., https://api.example.com/webhook`. The validator accepts hostnames, IPv4 addresses, and `localhost`, with or without a scheme, but it rejects bracketed IPv6 literals. Always enter a complete `https://` URL.
|
|
|
|
|
- **Enter your Endpoint URL**: the full `https://` URL that receives the POST requests. This field is required. The label reads `Endpoint URL` when you reopen an existing integration. Invalid input shows `Please enter a valid url, e.g., https://api.example.com/webhook`. The validator accepts hostnames, IPv4 addresses, and `localhost`, with or without a scheme, but it rejects bracketed IPv6 literals. Always enter a complete `https://` URL.
|
|
|
|
|
- **Authentication**: pick the method your endpoint requires. The dropdown offers exactly four options, in this order:
|
|
|
|
|
- `No Authentication`: no `Authorization` header is added.
|
|
|
|
|
- `Basic Auth`: two separate fields, `Username` and `Password`. NetBird base64-encodes them and sends `Authorization: Basic <credentials>`. Do not enter them as a single `username:password` string.
|
|
|
|
|
|
Brandon Hopkins