Remove duplicate VM webhook?

InsightVM
1

I was editing an IConn workflow, and (because of not being able to revert changes in a workflow, and things just being draft), I had exported the working work flow, and imported that copy to make changes to, and test it. I enabled that one, and disabled the original.

I made an error in assuming that the “application ID” had changed when I did so, but it appears to have not done so. So I re-ran the JSON to activate the appropriate webhook for VM. Now we’re getting duplicate messages in Slack for those events.

How can I remove the duplicate webhook, and any others that I no longer need?

2

Are you getting duplicate messages in the SAME Slack channel? As in the same workflow is essentially created twice?

3

Yeah.

Except it’s a duplicate webhook – created with the same ID. I verified -that- part with Postman.

In an effort to not have an extra 1000-plus notifications to Slack (I logged in to find some 3500 alerts between two work flows, since late Friday), I disabled the one workflow, re-imported it, and verified that THIS time it has a different app ID before I enabled the webhook.

But I would still like to remove the duplicated or unused webhooks.

4

So within ICON there is no central management for Webhooks. It would be through the workflow itself.

So you either have two workflows doing the same action of the webhook or a single workflow that has multiple steps that both trigger the same webhook.

If you narrowed all of those messages down to a single workflow I wouldn’t cycle through the actions to ensure there isn’t a duplicate action step to trigger that webhook.

5

This is on the VM webhook side, not IConn.

{
[first webhook],
{
“id”: “31dab35d-07a8-43d1-8e44-a581f01ded22”,
“name”: “Send Remediated Vulnerabilities Message in Slack from InsightVM”,
“destination_url”: “https://us2.api.insight.rapid7.com/connect/v1/execute/async/triggers/95ec8f15-9494-48c3-be54-69a6d59fc63a”,
“owner”: “PLATFORM_USERNAME”,
“secret”: “<>”,
“authentication”: {
“type”: “api-key”
},
“event_subscriptions”: {
“asset”: {
“asset_events”: null,
“vulnerability_events”: {
“asset_vulnerabilities_found”: false,
“asset_vulnerabilities_remediated”: true
}
}
}
},
[unused webhook, needs removed],
[unused webhook, needs removed],
{
[working webhook]
},
{
“id”: “649ec0da-bee7-4182-a035-f23dd2beb03e”,
“name”: “Send Remediated Vulnerabilities Message in Slack from InsightVM”,
“destination_url”: “https://us2.api.insight.rapid7.com/connect/v1/execute/async/triggers/95ec8f15-9494-48c3-be54-69a6d59fc63a”,
“owner”: “PLATFORM_USERNAME”,
“secret”: “<>”,
“authentication”: {
“type”: “api-key”
},
“event_subscriptions”: {
“asset”: {
“asset_events”: null,
“vulnerability_events”: {
“asset_vulnerabilities_found”: false,
“asset_vulnerabilities_remediated”: true
}
}
}
},
{[unused webhook, needs removed]
},
{
[working webhook] },
{[working webhook]
]
}

If you look at the “trigger” URL, it is the same trigger ID. Which sets off the same workflow, twice, as verified by the Jobs queue.

6

There is no direct integration from InsightVM to Slack so any workflow you created would have had to be something through InsightConnect as far as I understand.

Can you show a screenshot from within the tool what it is you’re looking at?

7

I asked very specifically on how to delete an extraneous webhook on the InsightVM experimental webhook API.

I would appreciate the command or method to do so.

8

Good afternoon! This is something that will need to be completed by the support team as there is no public facing documentation around deleting platform related webhooks at this time.

1 Like
9

Thank you.