Webhooks

SECURITY  Refer to Sites > Monitor in Permissions.

NAVIGATION  Policies > Monitoring > click the name of a policy > Add Monitor

NAVIGATION  Policies > All > click the name of a Monitoring policy > Add Monitor

NAVIGATION  Global > Policies > click the name of a Monitoring policy > Add Monitor

NAVIGATION  Sites > All Sites > click the name of a site > Policies (left navigation menu) > click the name of a Monitoring policy > Add Monitor

NAVIGATION  Device Summary page > Monitors card > Create a Monitor. To view the various navigation paths you can use to access the Device Summary page, refer to Device Summary.

About

Webhooks provide you with the capability to customize alert content and actions to external systems, allowing you to be notified about alerts and resolutions for critical issues directly where you work. Some examples external systems include the following:
• Microsoft Teams
• Slack
• Power Automate
• Zapier

Webhook notifications in Datto RMM support separate payloads for when an alert is triggered and (optionally) when an alert is resolved. Notifications can be configured with variables to provide detailed alert information when creating or editing a monitor either as part of a policy or as a device-level monitor. For more information, refer to Response details.

VIDEO  Webhook Notifications Partner Interview
Join Senior Product Manager Frederick Bendžius-Drennan for an exclusive MSP interview to discuss webhooks in the New UI, including examples of webhook notifications for Microsoft Teams and Power Automate.

How to...

To send a webhook, configure the following options within the Response section of a monitor:

Field Description
When Alert is Triggered Toggling this button to ON enables the rest of the fields.
When Alert is Resolved (Optional) Toggling this button to ON will enable the Alert Resolved Payload section. This secondary payload is optional and can be added to signal the resolution of an alert.
URL Enter a destination URL (provided by the third-party software).

NOTE  Both alert triggered and alert resolved payloads target the same URL.
Content Type Select one of the following data formats from the drop-down list:
• application/json (default)
• text/plain
• application/x-www-form-urlencoded
Alert Raised Payload Enter a message to be sent when an alert is triggered. For details, refer to Creating payloads.
Alert Resolved Payload Only displayed if the When Alert is Resolved (Optional) button is toggled to ON. Enter a message to be sent when an alert is resolved. For details, refer to Creating payloads.

NOTE  Alert resolved payloads are only sent when alerts are automatically resolved. Manually resolved alerts will not trigger an alert resolved payload.

Creating payloads

Payloads are customizable messages that have similar functionality to the way alert email subject lines can be customized with details about the alert. The third-party software you are creating a webhook for will describe how to format a valid payload. The following Datto RMM variables are supported for use within payloads:

  • [device_id]: The device ID (string value).
  • [device_uid]: The unique identifier of the device.
  • [device_hostname] or [hostname]: The hostname of the device.
  • [device_os] or [os]: The operating system of the device.
  • [device_description] or [description]: The description of the device.
  • [device_ip] or [ip]: The external IP address (public IP address) of the device.
  • [device_udf1] - [device_udf30] or [user-defined1] - [user-defined30]: User-defined field number. Refer to User-defined fields.
  • [last_user] or [lastuser]: The login name of the user that last logged in to the device.
  • [site_id]: The site ID (string value).
  • [site_uid]: The site ID.
  • [sitename] or [site_name]: The name of the site in which the device resides.
  • [alertuid] or [alert_uid]: The alert ID.
  • [alert_type] or [type]: The type of the alert raised (for example, memory or disk usage).
  • [alert_category] or [category]: The category of the alert raised (for example, performance or event log).
  • [platform]: The Datto RMM platform (for example, Concord or Merlot).
  • [alert]: The trigger details of the monitor that raised the alert.
  • [alert_message] or [alert_message_en]: The contents of the alert message in English.
  • [alert_message_de]: The contents of the alert message in German.
  • [alert_message_fr]: The contents of the alert message in French.

Whether a webhook is configured and a payload will be sent for an alert triggered or alert resolved event will be listed on policy and monitor panes within Datto RMM. Refer to Monitoring policy and Monitors.

Viewing payloads

Sent messages will be displayed on the Single Alert View page within the Timeline card. Refer to Timeline. The entire payload will be displayed, and if any variables were used within the payload, the variable values will also be shown. Click Show More or Show Less to expand or collapse the contents of the payload.

If an error occurs, an error message will be displayed on the Timeline card.

Click Test Webhook to refine or troubleshoot your messages. The payload will be sent as if the alert was triggered. If there are two payloads configured, both will be tested at once; the secondary payload will be sent as if the alert was resolved.

A success message will be displayed if the webhook was sent successfully. If there is an issue with the URL, content type, payload, or the third-party service itself, the related error message will be displayed.

Examples

  1. Log in to Microsoft Teams and configure a connector. For more information, refer to this Microsoft article.
  2. Create your payload using JSON. There are many resources available online for creating webhook notifications in Microsoft Teams channels. For more information about how to construct JSON blobs to send to Microsoft Teams, refer to this article. We have also created templates for both alert triggered and (optional) alert resolved payloads. Refer to Payload templates.

    3. NOTE  Microsoft Teams does not accept text/plain format.

  3. Create and configure a monitor in Datto RMM. Refer to Monitoring policy and Monitors. In the Send a Webhook section of the monitor's response details, enter your payload.
  4. Click Test Webhook to test the functionality (recommended). This will send both the alert triggered and the alert resolved (if configured) payload to Microsoft Teams.

NOTE  The following Microsoft Teams error is a known issue and has been observed to occur intermittently when testing a webhook:

Webhook test failed. I/O error on POST request for "https://<subdomain>.webhook.office.com/webhookb2/<unique-key-1>/IncomingWebhook/<unique-key-2>/<unique-key-3>": Connection reset; nested exception is javax.net.ssl.SSLException: Connection reset.

  1. Navigate to Your Apps in Slack, then click Create New App.
    For more information, refer to this Slack article.
  2. Select From Scratch.
  3. Enter a name for the app, select your workspace from the drop-down list, and then click Create App.
  4. Select Incoming Webhooks, then toggle the Activate Incoming Webhooks button to ON.
  5. Scroll down to the Webhook URLs for Your Workspace section, then click Add New Webhook to Workspace.
  6. Select a Slack channel from the drop-down list, then click Authorize.
    The unique webhook URL will be displayed. To add more webhooks, repeat the steps above.
  7. Create your payload using JSON. There are many resources available online for creating webhook notifications in Slack channels. For more information about how to construct JSON blobs to send to Slack, refer to the Slack Block Kit Builder. We have also created a payload template. Refer to Payload templates.

    8. NOTE  Slack does not accept text/plain format.

  8. Create and configure a monitor in Datto RMM. Refer to Monitoring policy and Monitors. In the Send a Webhook section of the monitor's response details, enter your payload.
  9. Click Test Webhook to test the functionality (recommended). This will send both the alert triggered and the alert resolved (if configured) payload to Slack.

The following are example JSON blobs that can be used when creating messages.

NOTE  To copy a block of code, hover over the code block and select Copy in the upper-right corner.

{
	"@type": "MessageCard",
	"@context": "http://schema.org/extensions",
	"themeColor": "0076D7",
	"summary": "New Datto RMM alert",
	"sections": [
		{
			"activityTitle": "New security alert on [device_hostname] | [site_name]",
			"activitySubtitle": "IP address: [device_ip] | Last user: [lastuser]",
			"activityImage": "https://i.imgur.com/YJhsAgQ.png",
			"facts": [
				{
					"name": "Category",
					"value": "[alert_category]"
				},
				{
					"name": "Description",
					"value": "[alert_message]."
				},
				{
					"name": "Immediate actions",
					"value": "Verify [device_hostname] was successfully isolated from the network. Contact [last_user] and/or [site_name] to confirm device should remain off the network."
				}
			],
			"markdown": true
		}
	],
	"potentialAction": [
		{
			"@type": "OpenUri",
			"name": "View Device",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform]rmm.centrastage.net/device/[device_id]/[device_hostname]"
				}
			]
		},
		{
			"@type": "OpenUri",
			"name": "View Alert",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform]rmm.centrastage.net/alert/[alert_uid]"
				}
			]
		},
		{
			"@type": "OpenUri",
			"name": "Web Remote",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform].centrastage.net/csm/remote/rto/[device_id]"
				}
			]
		},
		{
			"@type": "OpenUri",
			"name": "View Site",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform]rmm.centrastage.net/site/[site_id]"
				}
			]
		}
	]
}
{
	"@type": "MessageCard",
	"@context": "http://schema.org/extensions",
	"themeColor": "0076D7",
	"summary": "Datto RMM alert resolved",
	"sections": [
		{
			"activityTitle": "Resolved alert on [device_hostname] | [site_name]",
			"activitySubtitle": "IP address: [device_ip] | Last user: [lastuser]",
			"activityImage": "https://i.imgur.com/YJhsAgQ.png",
			"facts": [
				{
					"name": "Category",
					"value": "[alert_category]"
				},
				{
					"name": "Description",
					"value": "[alert_message]."
				},
				{
					"name": "Immediate actions",
					"value": "This alert has been resolved."
				}
			],
			"markdown": true
		}
	],
	"potentialAction": [
		{
			"@type": "OpenUri",
			"name": "View Device",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform]rmm.centrastage.net/device/[device_id]/[device_hostname]"
				}
			]
		},
		{
			"@type": "OpenUri",
			"name": "View Alert",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform]rmm.centrastage.net/alert/[alert_uid]"
				}
			]
		},
		{
			"@type": "OpenUri",
			"name": "Web Remote",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform].centrastage.net/csm/remote/rto/[device_id]"
				}
			]
		},
		{
			"@type": "OpenUri",
			"name": "View Site",
			"targets": [
				{
					"os": "default",
					"uri": "https://[platform]rmm.centrastage.net/site/[site_id]"
				}
			]
		}
	]
}
{
	"blocks": [
		{
			"type": "header",
			"text": {
				"type": "plain_text",
				"text": "New monitoring alert on [device_hostname] | [site_name]",
				"emoji": true
			}
		},
		{
			"type": "section",
			"fields": [
				{
					"type": "mrkdwn",
					"text": "*Category:* [alert_category]"
				},
				{
					"type": "mrkdwn",
					"text": "*Description:* [alert_message_en]"
				},
				{
					"type": "mrkdwn",
					"text": "*Alert Type:* [alert_type]"
				},
				{
					"type": "mrkdwn",
					"text": "*Trigger Details:* [alert]"
				}
			]
		},
		{
			"type": "divider"
		},
		{
			"type": "section",
			"fields": [
				{
					"type": "mrkdwn",
					"text": "*Device Description:* [device_description]"
				},
				{
					"type": "mrkdwn",
					"text": "*Last User:* [lastuser]"
				},
				{
					"type": "mrkdwn",
					"text": "*OS:* [device_os]"
				}
			]
		},
		{
			"type": "section",
			"fields": [
				{
					"type": "mrkdwn",
					"text": "<https://[platform]rmm.centrastage.net/device/[device_id]/|View Device>"
				},
				{
					"type": "mrkdwn",
					"text": "<https://[platform]rmm.centrastage.net/alert/[alert_uid]/|View Alert>"
				},
				{
					"type": "mrkdwn",
					"text": "<https://[platform].centrastage.net/csm/remote/rto/[device_id]/|Web Remote>"
				},
				{
					"type": "mrkdwn",
					"text": "<https://[platform]rmm.centrastage.net/site/[site_id]/|View Site>"
				}
			]
		},
		{
			"type": "divider"
		},
		{
			"type": "context",
			"elements": [
				{
					"type": "plain_text",
					"text": "Template provided by Datto without any warranty",
					"emoji": true
				}
			]
		}
	]
}