Cloud HTTP Integration

Realm exposes an HTTPS webhook endpoint that applications, log pipelines, and SaaS products can POST log data to directly. Each Cloud HTTP input feed gets its own webhook URL and authentication settings, so you can push data into Realm without additional middleware.

Prerequisites

1. Access to the Realm Security console.
2. A log source that can POST data over HTTPS and reach Realm Cloud on port 443.

Create a Source in Realm

1. In Realm, go to Sources > Add Source.
2. Enter a name for your source.
3. Set Product Format to match the logs being sent. Cloud HTTP is available for Custom CEF, Custom CSV, Custom JSON, and many vendor formats. See Source Guides That Use Cloud HTTP.
4. Click Save.

Add a Cloud HTTP Input Feed

1. On the Select Transport Method step in the Add Source flow, or from the source page, click Add Input Feed.
2. Select Cloud HTTP and give it a name.
3. Configure the input feed:

   Authentication Method: Auth Token, HMAC, or Shared Secret
   TLS Issuer: Public or Realm Private CA

4. Fill in the fields for the selected authentication method. See Authentication Methods.
5. Click Add. Realm displays the connection details for the new input feed.

Note: Use Public unless your log source requires a private trust chain. Clients connecting to a Public endpoint only need up-to-date system CA certificates.

Authentication Methods

Cloud HTTP supports the following authentication methods. Pick the one your log source supports.

Method	Use When	How Realm Verifies the Request
Auth Token	The source can send a static Authorization: Bearer header	Compares the bearer token with the feed's token
HMAC	The source signs each request body with a secret and sends the signature in a header	Recomputes an HMAC-SHA256 signature of the request body and compares it with the header value
Shared Secret	The source includes a plaintext secret as a field in the JSON request body	Compares the body field with the feed's shared secret

Realm rejects requests that fail verification with an error response instead of HTTP 200.

Auth Token

Authentication Method: Auth Token
Token: Optional. Leave empty to have Realm generate a random token, or enter your own value.

The source must send the token in an Authorization: Bearer <token> header on every request.

HMAC

Authentication Method: HMAC
Webhook Secret: The secret the source uses to sign webhook payloads. Required.
HMAC Signature Header: The name of the header that carries the signature, for example Linear-Signature. Required.

Realm computes an HMAC-SHA256 of the raw request body using the webhook secret, hex-encodes it in lowercase, and compares it with the value of the signature header. The header value must be the bare hex digest, without a prefix such as sha256=.

Note: Realm does not generate the webhook secret. Use the secret provided by your source, or generate one and configure it on both sides.

Shared Secret

Authentication Method: Shared Secret
Shared Secret: The secret the source includes in each webhook payload. Required.
Shared Secret Field: The name of the JSON field in the request body that carries the secret, for example sharedSecret. Required.

Realm parses the request body as a JSON object and compares the value of the shared secret field with the configured secret. The field must be at the top level of the body, so this method only works for sources that send a single JSON object per request.

View Connection Details

1. Click ... > View on the Cloud HTTP input feed.
2. Copy the connection details:

   Hostname: https://<feed-id>.<account-id>.http.ingest.realmsec.net
   Port: 443
   Protocol: SSL / TLS

3. If you selected Realm Private CA, copy the Realm CA pem file and add it to your log source's TLS settings.
4. If you selected Auth Token, click ... > Edit on the input feed, then click the eye icon in the Token field to reveal the token value, and copy the Token.

Important: Treat the token, webhook secret, and shared secret as secrets. Anyone with the hostname and a valid secret can send data to this input feed.

Send Data to Realm

Configure your log source to POST events to the Hostname, authenticating with the method configured on the input feed. The examples below send a JSON event. For CEF and CSV payloads, see the Custom CEF and Custom CSV guides.

Auth Token request:

curl -X POST "https://<feed-id>.<account-id>.http.ingest.realmsec.net" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"timestamp":"2024-01-01T00:00:00Z","event":"login","user":"alice"}'

HMAC request:

read -rs WEBHOOK_SECRET
BODY='{"timestamp":"2024-01-01T00:00:00Z","event":"login","user":"alice"}'
SIGNATURE=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $NF}')
curl -X POST "https://<feed-id>.<account-id>.http.ingest.realmsec.net" \
  -H "Content-Type: application/json" \
  -H "<signature_header>: $SIGNATURE" \
  --data-binary "$BODY"

Replace <signature_header> with the HMAC Signature Header configured on the input feed. Sign the exact bytes you send — any change to the body after signing, including whitespace, causes verification to fail.

Shared Secret request:

curl -X POST "https://<feed-id>.<account-id>.http.ingest.realmsec.net" \
  -H "Content-Type: application/json" \
  -d '{"sharedSecret":"<shared_secret>","timestamp":"2024-01-01T00:00:00Z","event":"login","user":"alice"}'

Replace sharedSecret with the Shared Secret Field configured on the input feed.

Note: Realm returns HTTP 200 on successful ingestion. Retry on 429 (rate limited) or 5xx responses using exponential backoff.

Source Guides That Use Cloud HTTP

1. Custom CEF
2. Custom CSV
3. Custom JSON
4. Cisco Meraki Webhook — Shared Secret
5. Cloudflare — HTTP Logpush
6. Imperva Cloud WAF
7. Linear Audit Logs — HMAC
8. Mimecast Email
9. Zscaler NSS Cloud CrowdStrike
10. Zscaler NSS Cloud Sentinel
11. Zscaler NSS Cloud Splunk

Troubleshooting

Authentication errors with Auth Token (HTTP 401)

1. Confirm the Authorization header uses the format Bearer <token>.
2. Ensure there are no leading or trailing spaces in the token value.

Requests rejected with HMAC

1. Confirm the source sends the signature in the header named in HMAC Signature Header.
2. Confirm the signature is a lowercase hex HMAC-SHA256 digest of the exact request body, without a prefix such as sha256=.
3. Confirm the Webhook Secret matches the secret configured in the source.

Requests rejected with Shared Secret

1. Confirm the request body is a single JSON object.
2. Confirm the secret is in a top-level field whose name matches Shared Secret Field.
3. Confirm the Shared Secret matches the value configured in the source.

TLS / certificate errors

1. For Public input feeds, ensure the host has up-to-date CA certificates installed.
2. For Realm Private CA input feeds, ensure the source trusts the Realm CA pem file copied from the input feed.

Support

If you encounter any issues or require assistance, contact Realm Security support.