Skip to main content

HTTP Request Variables

Completed
Simon Faulkner

HI All,

I would like to send events to Pushover.net for alerts on Analytics Events, mostly Intrusion Detection

I have the HTTP Do request working and the alerts come through but I can not for the life of me get NX to expand the variables such as {event.source}

I have tried in the HTTP(S) Content box in JSON eg  "title":{event.source},

and in line in the HTTP(S) URL

eg https://api.pushover.net/1/messages.json?title={event.source}

Am I using the wrong syntax?

0

Comments

7 comments

Date Votes
  • Norman
    • Network Optix team

    Hi Simon Faulkner,

    Support for Pushover.net falls outside our usual scope, but I took a quick look (though I haven't used and verified it myself) and would recommend trying the following:

    Please let me know if this helps! If not, I may (no promises if and when) take a closer look later, as I see potential use cases for Pushover.net myself.

    Best regards.

    0
  • Simon Faulkner
    Edited

    Thank you Norman, I have tried that syntax EXACTLY

    This is an Analytics Event  - "intrusion detection" and Pushover receives the message and generates an alert...

    So we know that token and user are passed through and work correctly

    BUT the message just says {event.source}

    ie it is NOT being expanded

    I have tested all the placeholders and I can not get any of them to expand :-(

    I hope it's just me being thick!

    0
  • Norman
    • Network Optix team

    Hi Simon Faulkner,

    Noted. Allow me some additional testing and get back at you.

    0
  • Simon Faulkner

    That's very kind of you sir, good luck

    0
  • Norman
    • Network Optix team
    Edited

    Hi Simon Faulkner,

    It took some time before I could review the issue. From my side, I was able to make everything work as I previously shared.

    Test Setup

    I have the following rule:

    Since no other triggers are available, I am using Generic Events to initiate the action. In this test, I use HTTP instead of HTTPS to allow packet inspection via Wireshark.

    Execution

    I trigger the Generic Event through our REST API (1) with a request body (2) that includes the Source and the applicable text. In this example, the source value is PlaceholderTest:

    To analyze network traffic, I filter my Wireshark output with api.pushover.net as the host filter, capturing only communication between my laptop and the api.pushover.net (1). As shown in the output, {event.source} is correctly replaced by the actual Source value, PlaceholderTest (3).

    Since authentication was not configured, the request results in an HTTP 404 (3). With proper authentication, the expected response would be HTTP 200.

    Additional Reference

    You can view a video demonstration of this test HERE. The only difference is that the video uses Caption instead of Source, but the results remain consistent.

    So, I would capture the communication between the source and the endpoint, so you can confirm the correct data is send to the endpoint.

    Best regards.

    0
  • Simon Faulkner

    Thank you for this Norman, I have followed your steps and event.caption does indeed expand when sent out in "Generic Event"

    However, I am afraid nothing expands in the event "Analytics Event"

    Is this perhaps something that could be fixed?

    I would be exceedingly grateful

    Simon

    0
  • Norman
    • Network Optix team

    Hi Simon Faulkner,

    If you use {event.source} while there is no Source content, nothing will be displayed. There are various other placeholders, you might need to use different placeholders.

    Could you capture the communication between the camera and server with Wireshark while an analytics event occurs? We’d like to review the HTTP content, ensuring that HTTPS is disabled. You can set the camera IP address as the host filter.

    I’ll be out of the office next week for a short holiday, so I won’t be able to test anything myself, but I can review the Wireshark file and provide feedback.

    Best regards.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post