Webhook Notifications Guide

NetRise Webhook Notifications

This document describes the structure and behavior of NetRise webhook notifications. Webhooks deliver real-time activity events from your NetRise organization to a configured HTTP endpoint.

Configuring Webhooks

Webhook configuration is managed from within the NetRise Turbine platform. You must have administrator permissions to create, edit, or delete webhooks.

Finding the Webhooks Page

1. Click Settings (gear icon) in the left sidebar navigation.
2. Select the Webhooks tab along the top of the Settings page.

This page displays all configured webhooks for your organization along with their name, payload URL, subscribed event count, last updated timestamp, the user who last modified them, and an enabled/disabled toggle.

Creating a Webhook

1. Click the + Add webhook button in the top-right corner of the Webhooks page.
2. Fill in the following fields:

1. Click Add to save the webhook.

Overview

Each webhook delivery is a JSON payload containing three top-level objects:

All webhook deliveries are real-time. A single delivery may contain multiple activities when they originate from the same triggering operation (e.g., a single analysis run updating many vulnerabilities at once). These related activities share a correlationId.

Service Object

The service block is included with every delivery and provides URLs for linking back to the NetRise platform.

These URLs can be used to construct deep links to specific assets, vulnerabilities, or other entities referenced in the activities.

Configuration Object

The configuration block is included with every delivery and describes the notification rule.

Subscribable Activity Types

The activityScopes array defines which event types trigger a delivery. The full set of available types:

Activity Object (Common Fields)

Every activity in the activities array shares these base fields:

Entity Types

Activity Type Details

Vulnerability Updated

Activity type: ASSET_ACTIVITY_TYPE_VULNERABILITY_UPDATED Entity type: ACTIVITY_ENTITY_TYPE_VULNERABILITY Payload key: vulnerabilityUpdated

Fired when metadata for an existing vulnerability changes. Common triggers include EPSS score refreshes, CVSS score assignments, severity reclassifications, exploit maturity updates, and known attack prevalence changes.

Each entry in entityUpdates:

Observed update fields:

Severity values: SEVERITY_NONE, SEVERITY_LOW, SEVERITY_MEDIUM, SEVERITY_HIGH, SEVERITY_CRITICAL

Exploit maturity values: unproven, poc, functional, high

Example:

{
  "auditLogId": "9b97824c-d1cf-4f34-af76-b3671323f561",
  "correlationId": "ea8ef95f-c405-43bd-baa6-ed64a9469aaa",
  "activityTime": "2026-05-12T22:14:27.984647Z",
  "orgId": "org_Pjw4doVth1Yl4j",
  "assetId": "GZ1LDaDubjwIIAqoTUNLK_n9x1S-sn9lqUdxc09l2Q",
  "entityType": "ACTIVITY_ENTITY_TYPE_VULNERABILITY",
  "activityType": "ASSET_ACTIVITY_TYPE_VULNERABILITY_UPDATED",
  "orgName": "Netrise Inc.",
  "assetName": "dotnet-sdk-9.0.304-win-x64.zip",
  "vulnerabilityUpdated": {
    "identificationId": "Xz06iEe6aLEAkCfhY5qtOg",
    "cveId": "CVE-2024-29059",
    "entityUpdates": [
      {
        "field": "known_attack_prevalence",
        "previous": "510",
        "current": "511"
      }
    ]
  }
}

Vulnerability Added

Activity type: ASSET_ACTIVITY_TYPE_VULNERABILITY_ADDED Entity type: ACTIVITY_ENTITY_TYPE_VULNERABILITY Payload key: vulnerabilityAdded

Fired when a new CVE is discovered on an asset, typically after initial analysis or when a new CVE is published that matches a component already in the asset's SBOM.

Note: A single analysis may produce many VULNERABILITY_ADDED activities for the same asset — one per CVE per affected component. These will share the same correlationId.

Example:

{
  "auditLogId": "b0bfd8a8-c155-4a46-a4c7-ca47f752f977",
  "correlationId": "ea8ef95f-c405-43bd-baa6-ed64a9469aaa",
  "activityTime": "2026-05-12T22:14:27.952198Z",
  "orgId": "org_PIw4doVtah1Yl4j",
  "assetId": "GZ1LDaDubjwIIAqoTUNLK_n9x1S-sn9lqUdxc09l2Q",
  "entityType": "ACTIVITY_ENTITY_TYPE_VULNERABILITY",
  "activityType": "ASSET_ACTIVITY_TYPE_VULNERABILITY_ADDED",
  "orgName": "Netrise Inc.",
  "assetName": "dotnet-sdk-9.0.304-win-x64.zip",
  "vulnerabilityAdded": {
    "identificationId": "Xz06iEe6aLEAkCfhY5qtOg",
    "cveId": "CVE-2026-32226",
    "entity": {
      "severity": "SEVERITY_MEDIUM",
      "cvssScore": 5.9,
      "exploitMaturity": "unproven"
    }
  }
}

Vulnerability Removed

Activity type: ASSET_ACTIVITY_TYPE_VULNERABILITY_REMOVED Entity type: ACTIVITY_ENTITY_TYPE_VULNERABILITY Payload key: vulnerabilityRemoved

Fired when a vulnerability is removed from an asset, typically after re-analysis determines the CVE no longer applies (e.g., the affected component was updated or the CVE was retracted).

Note: A single re-analysis may produce many VULNERABILITY_REMOVED activities. The same CVE may appear multiple times if it was associated with different components (identificationId values) within the asset.

Example:

{
  "auditLogId": "d640d8cd-3404-4305-8dea-6a0e8d6b14b0",
  "correlationId": "ea8ef95f-c405-43bd-baa6-ed64a9469aaa",
  "activityTime": "2026-05-12T22:14:27.969714Z",
  "orgId": "org_PjIw4oVtah1Yl4j",
  "assetId": "GZ1LDaDubjwIIAqoTUNLK_n9x1S-sn9lqUdxc09l2Q",
  "entityType": "ACTIVITY_ENTITY_TYPE_VULNERABILITY",
  "activityType": "ASSET_ACTIVITY_TYPE_VULNERABILITY_REMOVED",
  "orgName": "Netrise Inc.",
  "assetName": "dotnet-sdk-9.0.304-win-x64.zip",
  "vulnerabilityRemoved": {
    "identificationId": "xXsBNfmlUqHaJ5a8CXe02g",
    "cveId": "CVE-2024-38095",
    "entity": {
      "severity": "SEVERITY_HIGH",
      "cvssScore": 7.5,
      "exploitMaturity": "unproven"
    }
  }
}

Vulnerability Remediated

Activity type: ASSET_ACTIVITY_TYPE_VULNERABILITY_REMEDIATED Entity type: ACTIVITY_ENTITY_TYPE_VULNERABILITY Payload key: vulnerabilityRemediated

Fired when a vulnerability is marked as remediated via a VEX (Vulnerability Exploitability eXchange) assessment. This is a user-initiated action — activityUser will be present.

VEX Status values: VEX_STATUS_FIXED, VEX_STATUS_NOT_AFFECTED, VEX_STATUS_UNDER_INVESTIGATION

Note: The userReason field on the common activity object may contain a justification provided by the user when applying the remediation. It may also be empty.

Example:

{
  "auditLogId": "3bcc3e2e-c130-4247-b861-bb6ac883b885",
  "correlationId": "1079227d-cbc0-4516-94f6-736ce41a9746",
  "activityTime": "2026-05-12T15:14:21.962426Z",
  "orgId": "org_jIw4doVth1Yl4j",
  "assetId": "gCUeZfzLbbmhO-pQcwiQpgjOBfNVvSLDUPrR-72NChc",
  "entityType": "ACTIVITY_ENTITY_TYPE_VULNERABILITY",
  "activityType": "ASSET_ACTIVITY_TYPE_VULNERABILITY_REMEDIATED",
  "activityUser": "colin.lernihan@netrise.io",
  "userReason": "",
  "orgName": "Netrise Inc.",
  "assetName": "dotnet-sdk-9.0.105-win-x64.exe",
  "vulnerabilityRemediated": {
    "vulnerabilityId": "CVE-2023-24897",
    "componentName": ".net",
    "componentVersion": "6.0.0",
    "componentVendor": "microsoft",
    "vexData": {
      "status": "VEX_STATUS_FIXED"
    },
    "cveId": "CVE-2023-24897"
  }
}

Asset Risk Changed

Activity type: ASSET_ACTIVITY_TYPE_ASSET_RISK_CHANGED Entity type: ACTIVITY_ENTITY_TYPE_ASSET Payload key: assetRiskChanged

Fired when an asset's computed risk score or risk category changes, such as after vulnerability updates shift the overall risk profile.

Risk category values: RISK_CATEGORY_CRITICAL, RISK_CATEGORY_SIGNIFICANT, RISK_CATEGORY_MODERATE, RISK_CATEGORY_LOW, RISK_CATEGORY_MINIMAL

Note: oldRisk may be an empty object {} when the asset has just been analyzed for the first time.

Example:

{
  "auditLogId": "01fdc2c3-44c5-4b08-9f7a-caff4a63ef40",
  "correlationId": "463b6675-0b87-4a7b-8dd2-e7a1b5ac515f",
  "activityTime": "2026-05-01T21:40:03.885712Z",
  "orgId": "org_jIw4doVt1Yl4j",
  "assetId": "60Fqlh4prybGsJsq-uU_lDb_BybYZVuWhdHA9Dj2M8k",
  "entityType": "ACTIVITY_ENTITY_TYPE_ASSET",
  "activityType": "ASSET_ACTIVITY_TYPE_ASSET_RISK_CHANGED",
  "orgName": "Netrise Inc.",
  "assetName": "dumpfile.elf",
  "assetRiskChanged": {
    "assetType": "ASSET_TYPE_BINARY",
    "name": "dumpfile.elf",
    "vendor": "Ubuntu",
    "oldRisk": {
      "category": "RISK_CATEGORY_SIGNIFICANT",
      "score": 6.139
    },
    "newRisk": {
      "category": "RISK_CATEGORY_SIGNIFICANT",
      "score": 6.287
    }
  }
}

Asset Created

Activity type: ASSET_ACTIVITY_TYPE_ASSET_CREATED Entity type: ACTIVITY_ENTITY_TYPE_ASSET Payload key: assetCreated

Fired when a new asset is uploaded to the platform. This is always a user-initiated action, so activityUser will be present.

Example:

{
  "auditLogId": "2fa06ed7-64b9-493b-b1e9-659c795020cd",
  "correlationId": "f8cbe099-4c44-4617-83d7-a82a1545a1e2",
  "activityTime": "2026-05-12T22:04:18.094856Z",
  "orgId": "org_jIw4doVt1Yl4j",
  "assetId": "rGZ1LDaDubjwIIAqoTUNLK_n9x1S-sn9lqUdxc09l2Q",
  "entityType": "ACTIVITY_ENTITY_TYPE_ASSET",
  "activityType": "ASSET_ACTIVITY_TYPE_ASSET_CREATED",
  "activityUser": "colin.lernihan@netrise.io",
  "orgName": "Netrise Inc.",
  "assetName": "dotnet-sdk-9.0.304-win-x64.zip",
  "assetCreated": {
    "assetType": "ASSET_TYPE_BINARY",
    "name": "dotnet-sdk-9.0.304-win-x64.zip"
  }
}

Asset Analysis Completed

Activity type: ASSET_ACTIVITY_TYPE_ASSET_ANALYSIS_COMPLETED Entity type: ACTIVITY_ENTITY_TYPE_ASSET Payload key: assetAnalysisCompleted

Fired when the platform finishes analyzing (or re-analyzing) an asset. Typically followed by VULNERABILITY_ADDED and MISCONFIG_CHANGED activities.

Example:

{
  "auditLogId": "47818821-6ae1-4709-a0e3-0730e54d07c1",
  "correlationId": "6ab6445f-6e9a-42fd-a192-5fb3f3f119df",
  "activityTime": "2026-05-12T22:14:26.997817Z",
  "orgId": "org_jIw4doVtaYl4j",
  "assetId": "rGZ1LDaDubjwIIAqoTUNLK_n9x1S-sn9lqUdxc09l2Q",
  "entityType": "ACTIVITY_ENTITY_TYPE_ASSET",
  "activityType": "ASSET_ACTIVITY_TYPE_ASSET_ANALYSIS_COMPLETED",
  "orgName": "Netrise Inc.",
  "assetName": "dotnet-sdk-9.0.304-win-x64.zip",
  "assetAnalysisCompleted": {
    "assetId": "rGZ1LDaDubjwIIAqoTUNLK_n9x1S-sn9lqUdxc09l2Q",
    "revision": 4
  }
}

Misconfiguration Changed

Activity type: ASSET_ACTIVITY_TYPE_MISCONFIG_CHANGED Entity type: ACTIVITY_ENTITY_TYPE_MISCONFIGURATION Payload key: misconfigChanged

Fired when a configuration check result changes, typically after an analysis completes.

Behavioral Notes

Correlation IDs

The correlationId links activities that result from the same triggering operation. For example, when EPSS scores are refreshed across all assets, each asset's updates are delivered with a shared correlationId, and each CVE update is a separate activity within that delivery.

Duplicate CVEs Across Identifications

A single CVE may appear multiple times within the same delivery if it affects multiple software components (identifications) within the same asset. Each occurrence will have a distinct identificationId but the same cveId. This is expected — the vulnerability exists in multiple places within the asset.

Event Ordering

Activities within a delivery are ordered by activityTime. The activityTime values may have sub-second differences.

Initial Analysis Flow

When a new asset is uploaded and analyzed, the typical event sequence is:

1. ASSET_CREATED — the asset is uploaded (user-initiated, includes activityUser)
2. ASSET_ANALYSIS_COMPLETED — analysis finishes (revision 1)
3. VULNERABILITY_ADDED — one per CVE per component (often hundreds in a single delivery), each including severity, CVSS score, and exploit maturity
4. MISCONFIG_CHANGED — one per configuration check
5. ASSET_RISK_CHANGED — the computed risk score is assigned (with oldRisk as empty {})

Re-Analysis Flow

When an asset is re-analyzed (e.g., due to updated component data or manual re-submission):

1. ASSET_ANALYSIS_COMPLETED — revision increments (e.g., revision  greater than 1)
2. VULNERABILITY_ADDED — newly discovered CVEs, with full severity/CVSS/exploit metadata
3. VULNERABILITY_REMOVED — CVEs that no longer apply, with severity/CVSS/exploit metadata at time of removal
4. ASSET_RISK_CHANGED — risk score updated based on the new vulnerability profile

Ongoing Monitoring Flow

After initial analysis, ongoing events are typically triggered by external data updates:

• EPSS refreshes produce VULNERABILITY_UPDATED activities with epss_score changes across many assets simultaneously
• New CVE data (CVSS scores, severity assignments, exploit maturity changes) produce VULNERABILITY_UPDATED activities with multiple entityUpdates per activity
• Known attack prevalence updates produce VULNERABILITY_UPDATED activities with known_attack_prevalence field changes
• User-initiated remediations produce VULNERABILITY_REMEDIATED activities with full component context and VEX status

Turbine Asset Deep Links

You can link directly to any tab within an asset's detail view in Turbine using the following URL pattern:

https://turbine.netrise.io/assets/{assetId}%7C0/{tab}

Replace {assetId} with the asset's unique identifier and {tab} with one of the available tab paths below.

Available Tabs

Example

For an asset with ID lssj1Q9MS5mkCsdXRDe3KzYJ44eyv1jP7122pvHZQBY, the link to its Vulnerabilities tab would be:

https://turbine.netrise.io/assets/lssj1Q9MS5mkCsdXRDe3KzYJ44eyv1jP7122pvHZQBY%7C2/Vulnerabilities

Notes

• The %7C0 suffix after the asset ID is required — it is the URL-encoded form of |2.
• Tab paths with spaces use standard URL encoding (e.g., Public%20Keys, License%20Issues).
• The File System tab accepts a filePath query parameter to open directly to a specific directory.