--- url: https://docs.realmsec.info/integration/cloud_http.md --- # Cloud HTTP Integration Realm exposes an HTTPS webhook endpoint that applications, log pipelines, and SaaS products can POST log data to directly. Each Cloud HTTP input feed gets its own webhook URL and authentication settings, so you can push data into Realm without additional middleware. ## Prerequisites 1. Access to the Realm Security console. 2. A log source that can POST data over HTTPS and reach Realm Cloud on port `443`. ## Create a Source in Realm 1. In Realm, go to **Sources > Add Source**. 2. Enter a name for your source. 3. Set **Product Format** to match the logs being sent. Cloud HTTP is available for **Custom CEF**, **Custom CSV**, **Custom JSON**, and many vendor formats. See [Source Guides That Use Cloud HTTP](#source-guides-that-use-cloud-http). 4. Click **Save**. ## Add a Cloud HTTP Input Feed 1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**. 2. Select **Cloud HTTP** and give it a name. 3. Configure the input feed: > **Authentication Method:** `Auth Token`, `HMAC`, or `Shared Secret`\ > **TLS Issuer:** `Public` or `Realm Private CA` 4. Fill in the fields for the selected authentication method. See [Authentication Methods](#authentication-methods). 5. Click **Add**. Realm displays the connection details for the new input feed. > **Note:** Use **Public** unless your log source requires a private trust chain. Clients connecting to a **Public** endpoint only need up-to-date system CA certificates. ## Authentication Methods Cloud HTTP supports the following authentication methods. Pick the one your log source supports. | Method | Use When | How Realm Verifies the Request | |--------|----------|--------------------------------| | [Auth Token](#auth-token) | The source can send a static `Authorization: Bearer` header | Compares the bearer token with the feed's token | | [HMAC](#hmac) | The source signs each request body with a secret and sends the signature in a header | Recomputes an HMAC-SHA256 signature of the request body and compares it with the header value | | [Shared Secret](#shared-secret) | The source includes a plaintext secret as a field in the JSON request body | Compares the body field with the feed's shared secret | Realm rejects requests that fail verification with an error response instead of HTTP `200`. ### Auth Token > **Authentication Method:** `Auth Token`\ > **Token:** Optional. Leave empty to have Realm generate a random token, or enter your own value. The source must send the token in an `Authorization: Bearer ` header on every request. ### HMAC > **Authentication Method:** `HMAC`\ > **Webhook Secret:** The secret the source uses to sign webhook payloads. Required.\ > **HMAC Signature Header:** The name of the header that carries the signature, for example `Linear-Signature`. Required. Realm computes an HMAC-SHA256 of the raw request body using the webhook secret, hex-encodes it in lowercase, and compares it with the value of the signature header. The header value must be the bare hex digest, without a prefix such as `sha256=`. > **Note:** Realm does not generate the webhook secret. Use the secret provided by your source, or generate one and configure it on both sides. ### Shared Secret > **Authentication Method:** `Shared Secret`\ > **Shared Secret:** The secret the source includes in each webhook payload. Required.\ > **Shared Secret Field:** The name of the JSON field in the request body that carries the secret, for example `sharedSecret`. Required. Realm parses the request body as a JSON object and compares the value of the shared secret field with the configured secret. The field must be at the top level of the body, so this method only works for sources that send a single JSON object per request. ## View Connection Details 1. Click **`...` > View** on the Cloud HTTP input feed. 2. Copy the connection details: > **Hostname:** `https://..http.ingest.realmsec.net`\ > **Port:** `443`\ > **Protocol:** `SSL / TLS` 3. If you selected **Realm Private CA**, copy the **Realm CA pem file** and add it to your log source's TLS settings. 4. If you selected **Auth Token**, click **`...` > Edit** on the input feed, then click the eye icon in the **Token** field to reveal the token value, and copy the **Token**. > **Important:** Treat the token, webhook secret, and shared secret as secrets. Anyone with the hostname and a valid secret can send data to this input feed. ## Send Data to Realm Configure your log source to POST events to the **Hostname**, authenticating with the method configured on the input feed. The examples below send a JSON event. For CEF and CSV payloads, see the [Custom CEF](/integration/cef#cloud-http-webhook) and [Custom CSV](/integration/csv#cloud-http-webhook) guides. **Auth Token request:** ```shell curl -X POST "https://..http.ingest.realmsec.net" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer " \ -d '{"timestamp":"2024-01-01T00:00:00Z","event":"login","user":"alice"}' ``` **HMAC request:** ```shell read -rs WEBHOOK_SECRET BODY='{"timestamp":"2024-01-01T00:00:00Z","event":"login","user":"alice"}' SIGNATURE=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $NF}') curl -X POST "https://..http.ingest.realmsec.net" \ -H "Content-Type: application/json" \ -H ": $SIGNATURE" \ --data-binary "$BODY" ``` Replace `` with the **HMAC Signature Header** configured on the input feed. Sign the exact bytes you send — any change to the body after signing, including whitespace, causes verification to fail. **Shared Secret request:** ```shell curl -X POST "https://..http.ingest.realmsec.net" \ -H "Content-Type: application/json" \ -d '{"sharedSecret":"","timestamp":"2024-01-01T00:00:00Z","event":"login","user":"alice"}' ``` Replace `sharedSecret` with the **Shared Secret Field** configured on the input feed. > **Note:** Realm returns HTTP `200` on successful ingestion. Retry on `429` (rate limited) or `5xx` responses using exponential backoff. ## Source Guides That Use Cloud HTTP 1. [Custom CEF](/integration/cef#cloud-http-webhook) 2. [Custom CSV](/integration/csv#cloud-http-webhook) 3. [Custom JSON](/integration/json#cloud-http-webhook) 4. [Cisco Meraki Webhook](/integration/cisco_meraki_webhook) — Shared Secret 5. [Cloudflare](/integration/cloudflare) — HTTP Logpush 6. [Imperva Cloud WAF](/integration/imperva_cloud_waf#generic-http-push-beta) 7. [Linear Audit Logs](/integration/linear_audit) — HMAC 8. [Mimecast Email](/integration/mimecast_email) 9. [Zscaler NSS Cloud CrowdStrike](/integration/zscaler_zia_nss_cloud_crowdstrike) 10. [Zscaler NSS Cloud Sentinel](/integration/zscaler_zia_nss_cloud_sentinel) 11. [Zscaler NSS Cloud Splunk](/integration/zscaler_zia_nss_cloud_splunk) ## Troubleshooting **Authentication errors with Auth Token (HTTP 401)** 1. Confirm the `Authorization` header uses the format `Bearer `. 2. Ensure there are no leading or trailing spaces in the token value. **Requests rejected with HMAC** 1. Confirm the source sends the signature in the header named in **HMAC Signature Header**. 2. Confirm the signature is a lowercase hex HMAC-SHA256 digest of the exact request body, without a prefix such as `sha256=`. 3. Confirm the **Webhook Secret** matches the secret configured in the source. **Requests rejected with Shared Secret** 1. Confirm the request body is a single JSON object. 2. Confirm the secret is in a top-level field whose name matches **Shared Secret Field**. 3. Confirm the **Shared Secret** matches the value configured in the source. **TLS / certificate errors** 1. For **Public** input feeds, ensure the host has up-to-date CA certificates installed. 2. For **Realm Private CA** input feeds, ensure the source trusts the Realm CA pem file copied from the input feed. ## Support If you encounter any issues or require assistance, contact Realm Security support.