HTTP Client actions

HTTP Client actions let you automatically send incident information through an API request to your organization when conditions in your Policy Rules are met. Once your team receives the request, you can choose how to handle the incident based on the request.

Prerequisites

• An endpoint for HUMAN to send the request to.

• An HTTP integration, which you can access from Platform Settings > Integrations > HTTP. For more information, see our help article.

• An existing Account Defender policy rule to add the action to. See Create Account Defender policy rules for more information.

Set up HTTP Client Actions

To set up, you need to:

1. Create a Client action
2. Add an action to a Policy Rule

Create an HTTP Client action

Once you have connected your API endpoint with HUMAN’s HTTP integration, you must create a new HTTP Client action for HUMAN to take whenever a Policy Rule’s conditions are met.

1. Navigate to Account Defender > Settings > Action Settings.
2. Select Add Action.
3. Complete the following fields:
   • Action name: The name that will appear for the action throughout the HUMAN console.
   • Action type: The type of mitigation action you want to trigger with this action.
   • Cooldown duration: The length of time Account Defender should wait to trigger this action each time it detects a match on the rule it’s assigned to.
   • Duration unit: The unit of time for the cooldown.
   • Application data source: The application the action will be available on.
   • Event type: The type of event the action will be triggered by.
   • Integration: Select the HTTP integration to be triggered by the action.
   • Field selection: Select any additional fields you want to include in HUMAN’s request body. The available fields are determined by the Event type you selected. Default fields are required and cannot be removed. You can review the definitions per field in Client Action request fields definitions and examples per event type in Request examples.
4. Review the sample request body and select Send test request to test the action.
5. Once you’re satisfied with your settings, select Save changes.

Next, be sure to add your Action to a Policy Rule so it triggers automatically.

Add an HTTP action to a Policy Rule

Once you have created an HTTP Client action, we recommend adding it to a Policy Rule so you can automate when a request is sent to your organization.

1. Navigate to Account Defender > Policies > Policy Rules.
2. Select Create new rule or select an existing rule to edit it.
   3.Select Actions and navigate to API-based actions, which should display your HTTP Client Actions.
3. In the Then section, drag and drop the HTTP Client Action that should be triggered when the If condition is met.
4. Select Save.

Your Policy Rule has been updated with your action. Now, whenever your rule is triggered, HUMAN will send a request to your specified endpoint with the fields you selected while creating the action.

HTTP Client action request fields definitions

You can customize the sent request body. The available fields for single and network events are slightly different.

Default fields

Default fields are required and cannot be removed.

Non-default fields

Request examples

You can review request examples per event type below.

Single event request

1
{
2
    "user_id": "12345",
3
    "score": 0.99,
4
    "attack_type": "ato",
5
    "attack_patterns": [
6
        "non_withdrawing_account"
7
    ],
8
    "rule_id": "cfa7d19b-3b06-4514-9924-d1eb77fc9791",
9
    "rule_name": "ATO with high score",
10
    "action_name": "Reset password",
11
    "timestamp": "2024-05-12T15:11:27.745Z",
12
    "additional": {
13
        "city": "Tel Aviv",
14
        "country": "IL",
15
        "ip": "15.5.133.81",
16
        "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.124 Safari/537.36 Edg/102.0.1245.44"
17
    }
18
}

Network event request

1
{
2
  "user_ids": ["92549020", "92549021", "92549022"],
3
  "score": 0.98,
4
  "attack_type": "fake_account",
5
  "rule_id": "84734834",
6
  "action_name": "account_suspension",
7
  "timestamp": "2022-06-24T15:13:52.164Z",
8
  "additional": {
9
    "network_id": "320",
10
    "network_type": "vid",
11
  }
12
}