Examples / Cloud events: AWS, Google Cloud and Azure / AWS GuardDuty and Security Hub findings (via EventBridge)

AWS GuardDuty and Security Hub findings (via EventBridge) webhooks

Security findings as they are created or updated, routed by an EventBridge rule to SNS or an API destination.

Events

GuardDuty Finding
Security Hub Findings - Imported
Security Hub Findings - Custom Action

Signature

SNS envelope signature, or the auth you configured on an API destination.

Retries

EventBridge retries up to 24 hours; SNS per its policy.

See a retry schedule in the calculator.

Docs

docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding...

Checked 2026-10-09. Report a change.

Sample request from AWS GuardDuty and Security Hub findings (via EventBridge)illustrative, shortened

Content-Typeapplication/json; charset=utf-8User-AgentAmazon/EventBridge/ApiDestinations

{
  "version": "0",
  "detail-type": "GuardDuty Finding",
  "source": "aws.guardduty",
  "account": "123456789012",
  "region": "eu-central-1",
  "time": "2026-10-09T06:34:00Z",
  "detail": {
    "type": "UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS",
    "severity": 8,
    "title": "Credentials for instance i-0abc… used from an external IP",
    "resource": { "resourceType": "AccessKey", "accessKeyDetails": { "userName": "shop-api-role" } },
    "service": { "count": 1, "eventFirstSeen": "2026-10-09T06:30:12Z" }
  }
}

Receive AWS GuardDuty and Security Hub findings (via EventBridge) webhooks with webhooks.xyz

Create a bin. Paste its URL into AWS GuardDuty and Security Hub findings (via EventBridge). Each request shows at once with its headers and body. Add your server as a destination, and deliveries retry when it is down. Request an invite.

More in cloud events: aws, google cloud and azure: AWS Budgets and Cost Anomaly Detection (via SNS), AWS CloudWatch alarms (via SNS), AWS CodePipeline and CodeBuild (via SNS or EventBridge), AWS EventBridge API destinations, AWS S3 event notifications (via SNS), AWS SES notifications (via SNS), AWS SNS (HTTPS subscriptions), Azure DevOps service hooks, Azure Event Grid webhooks, Azure Logic Apps and Power Automate (HTTP action), Azure Monitor action group webhooks, Google Cloud Billing budgets (via Pub/Sub), Google Cloud Build notifications (via Pub/Sub), Google Cloud Monitoring alerting webhooks, Google Cloud Pub/Sub push subscriptions.