Webhook URL Requirements and Verification

Overview

For DDR streaming to function with remote data sources such as SharePoint Online, OneDrive, and Google Drive, the Forcepoint DSPM webhook endpoint must be reachable from the respective cloud provider's datacenters. If the URL is inaccessible or presents an untrusted TLS certificate, event delivery will fail silently - DDR will not detect file changes in near real time.

This topic is intended for network administrators and IT engineers responsible for deploying and maintaining on-premises installations of Forcepoint DSPM.

Autogenerated DDR Webhook Endpoint

The dedicated DDR notification endpoint is autogenerated during installation. No manual URL creation is required. The endpoint is available immediately after installation and follows this path pattern:

https://${HOST_DOMAIN}/scan-manager/external/webhooks/notification/${WEBHOOK_ID}

https://acme.example.com/scan-manager/external/webhooks/notification/a42f511f0e94c77cfcf4a0f8e16f60ed649dc9947abd81410fa50cec7c5b366c

The trailing segment is a unique identifier per webhook and will differ for each configured data source.

https://${HOST_DOMAIN}/scan-manager/external/webhooks/notification/

Requirements

Before configuring DDR streaming for any remote data source, verify that all of the following requirements are met.

Verification Steps

Follow these steps to confirm the webhook URL is accessible and trusted before configuring streaming for any data source.

1. Test connectivity without enabling streaming (test endpoint)
   Before enabling DDR streaming for any data source, use the built-in test endpoint to verify that the webhook URL is publicly reachable and the TLS certificate is trusted. Run the following command from a server or VM located outside your corporate network - for example, a cloud VM in the same region as the data source:

   curl -v https://${HOST_DOMAIN}/scan-manager/external/webhooks/notification/test

   A successful response is an HTTP 204 No Content. This confirms the URL is reachable and the TLS certificate is accepted by the client. The following is an example of a successful response:

   < HTTP/2 204
   < cache-control: no-cache, no-store, max-age=0, must-revalidate
   < strict-transport-security: max-age=15552000; includeSubDomains
   < x-content-type-options: nosniff
   < x-frame-options: SAMEORIGIN
   < x-xss-protection: 1; mode=block
   

   A curl: (60) SSL certificate error or a connection timeout indicates a misconfiguration that must be resolved before proceeding.

2. Test connectivity from a server-side tool or external node

   Run the following command from a server or VM that is located outside your corporate network. Do not run this from a local workstation. Replace the test path segment with an actual webhook ID once streaming is enabled:

   curl -v https://${HOST_DOMAIN}/scan-manager/external/webhooks/notification/${WEBHOOK_ID}

3. Validate the TLS certificate

   Use an external SSL validation tool such as SSL Labs Server Test to verify all of the following:

   • The certificate is issued by a widely trusted CA.
   • The certificate chain is complete with no missing intermediates.
   • The certificate has not expired.
   • The certificate hostname matches the DDR webhook URL.
   • No known protocol vulnerabilities (such as TLS 1.0 or weak ciphers) are present.
4. (Optional) - Test from a node in the relevant cloud region

   For the highest confidence, provision a temporary VM in the relevant cloud region and run the curl command from Step 2 from that node. This closely simulates the actual network path that cloud provider webhooks will use to deliver events.

   • For SharePoint Online and OneDrive: use an Azure VM in the same region as your Microsoft 365 tenant.
   • For Google Drive: use a Google Cloud VM in the appropriate region.

Best Practices