Ismalicious Com Webhooks

generated: '2026-11-12'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://ismalicious.com/api-docs/webhooks
sources:
- https://ismalicious.com/api-docs/webhooks
description: User webhooks deliver platform events to registered HTTPS endpoints.
events:
- event: threat.detected
  description: 'A watched domain or IP became a threat: named on a ransomware leak site, or newly flagged malicious by its watch check.'
- event: monitor.alert
  description: A monitored domain or IP changed status or raised a new alert.
- event: report.created
  description: A new threat report was saved.
- event: usage.warning
  description: Usage is approaching a plan limit.
- event: cve.finding.created
  description: A CVE affects a component of your watched stack.
- event: cve.finding.status_changed
  description: A finding moved to a new status, set by a member or closed by a read of the fixed version.
- event: case.updated
  description: A case status, priority or evidence timeline changed.
- event: dataset.stale
  description: A dataset passed its freshness threshold or became unavailable.
- event: cve.finding.escalated
  description: 'A CVE in your stack has new evidence: added to CISA KEV, exploitation reported, a public proof of concept or a fix released.'
- event: cve.exploited
  description: A CVE became exploited (CISA KEV, another exploitation catalogue, CISA SSVC active). Sent only to subscriptions that name this
    event.
- event: cve.digest
  description: The daily or Monday digest of what is new or changed on your watched stack.
delivery:
  signature: 'Each delivery includes the header X-IsMalicious-Signature: t=<timestamp>,v1=<HMAC-SHA256 hex of "<timestamp>.<body>" with the endpoint''s
    whsec_ secret>'
  content_type: application/json POST to the registered HTTPS URL with additional headers X-IsMalicious-Event, X-IsMalicious-Delivery, X-IsMalicious-Timestamp,
    and X-IsMalicious-Signature for verification using the per‑endpoint whsec_ secret generated at creation.
note: A 5xx response or a network error triggers a single retry; redirects are not followed.
docs: https://ismalicious.com/api-docs/webhooks