{
  "_comment": "Message body for a custom webhook action, for example an automation platform listening on a generic webhook. Paste the object below (without this _comment key) into the action Message field. Variable names are Mustache context variables documented by OpenSearch Alerting; the _source field paths are Wazuh Common Schema fields documented for Wazuh 5.0 findings. A per-document monitor exposes matched documents under ctx.alerts.0.sample_documents.0._source, which is the form the Wazuh migration guide uses.",

  "source": "wazuh",
  "monitor": "{{ctx.monitor.name}}",
  "trigger": "{{ctx.trigger.name}}",
  "trigger_severity": "{{ctx.trigger.severity}}",
  "period_start": "{{ctx.periodStart}}",
  "period_end": "{{ctx.periodEnd}}",
  "finding": {
    "rule_id": "{{ctx.alerts.0.sample_documents.0._source.wazuh.rule.id}}",
    "rule_title": "{{ctx.alerts.0.sample_documents.0._source.wazuh.rule.title}}",
    "rule_level": "{{ctx.alerts.0.sample_documents.0._source.wazuh.rule.level}}",
    "agent_id": "{{ctx.alerts.0.sample_documents.0._source.wazuh.agent.id}}",
    "agent_name": "{{ctx.alerts.0.sample_documents.0._source.wazuh.agent.name}}",
    "source_ip": "{{ctx.alerts.0.sample_documents.0._source.source.ip}}",
    "file_path": "{{ctx.alerts.0.sample_documents.0._source.file.path}}",
    "event_original": "{{ctx.alerts.0.sample_documents.0._source.event.original}}"
  }
}