Using webhooks to boost cloud-native application security

In the ever-evolving landscape of cloud-native applications built with containers and Kubernetes, webhooks serve as the communication backbone, facilitating seamless integration between various components, especially in the realms of security, networking, and troubleshooting. This is further amplified when combined with popular collaboration tools such as Jira and Slack.

Webhooks play a pivotal role in fortifying containers and Kubernetes security. By enabling real-time communication between different components, container security incidents can be detected promptly. For instance, webhooks can trigger alerts and notifications whenever suspicious activities, unauthorized access, or potential security breaches are identified. This ensures that security and DevOps teams can respond swiftly, mitigating risks and safeguarding the Kubernetes infrastructure.

In the absence of webhooks, the detection of security incidents could be delayed, impeding the swift response of security and DevOps teams to potential breaches. The synergy between components, especially in areas like security, networking, and troubleshooting, would be disrupted, hindering the seamless integration that webhooks bring to cloud-native applications. The absence of webhooks could leave a void in the efficiency and responsiveness of the Kubernetes infrastructure, making it more susceptible to risks and challenges.

Why use webhooks?

Collaboration tools

Webhooks can serve as the linchpin for integrating your cloud-native applications on Kubernetes and integrate with popular collaboration tools such as Jira and Slack. This integration ensures that teams are notified instantly about important events, enabling them to collaborate effectively. Additionally, the flexibility to integrate with any HTTP endpoint extends the reach of webhooks, allowing seamless communication with custom applications and services.

Threat alert automation and compliance

Security engineers can use webhooks to push alerts about detected threat activity in their cluster, along with relevant metadata, to Slack or Jira so that they or DevOps team can take a look at the issue, easily monitor alerts, and meet compliance requirements.

Getting Started: Requirements

• Calico Enterprise 3.19 or above; Calico Cloud
• Slack or Jira administrator role
• Calico WAF, Container Threat Detection, or other security features enabled (All alerts shown in Security Events page can be attached to a webhook)
• Calico Cloud or Calico Enterprise UI access

Getting Started: Deployment

Firstly, a new Slack or Jira application needs to be created. In this example, I will create a Slack application for incoming webhooks, following the official Slack documentation.

1. Create a new app:

2. Enable Incoming Webhooks and add it to your workspace:

NOTE: Make sure to copy the webhook URL.

Getting Started: Leveraging webhooks with workload-centric WAF for network-based threats

3. Connect the newly created webhook with Calico WAF:

After triggering some WAF alerts, I received messages in Slack and this is how it looks:

This is an example of the alert that I received in Slack:

This is an example of the alert that I received in Jira:

By default, WAF is in “Detection Only” mode. However, I have enabled “Blocking Mode” and changed the threshold score to fine-tune WAF with the test that I’m making with this blog. To do so, I followed the official documentation.

Now, I can see that the malicious activity is getting denied by the Calico WAF, while a non-malicious activity, which triggered an alert, was allowed as expected because its score was lower than the threshold:

Conclusion

Webhooks are indispensable in the cloud-native applications, serving as a linchpin for security, networking, and troubleshooting. Their integration with collaboration tools and ability to communicate with any HTTP endpoint amplifies their impact, making them a cornerstone in ensuring the reliability and performance of Kubernetes clusters. As organizations continue to embrace Kubernetes, leveraging the power of webhooks becomes not just a choice but a strategic necessity.

Ready to try Calico for yourself? Sign up for a free trial of Calico Cloud