Messaging and Ticketing Integrations

Available Messaging and Ticketing Integrations

1. Create an event destination in your third-party tool
2. Configure the integration in Material including adding triggering events

• Email
• Slack
• PagerDuty
• Atlassian

How to create a custom Messaging and Ticketing integration

One: Create an event destination in the third-party tool

1. Create and secure a webhook endpoint handler to receive event data requests (most often POST). Refer to your tool's documentation for instructions on how to do this.
2. Copy the endpoint URI and any required headers for use in the next section.

Two: Configure the Message and Ticketing integration in Material

1. In Material, click Integrations (the puzzle icon in the top toolbar).
2. Click Create New Integration
3. Under Messaging & Ticketing, click Custom Message and Ticketing. Complete the required fields:

Method

URI

Headers

Event

This is most often POST , however refer to your tool's documentation for the required method for their destination.

The full HTTPS destination or endpoint URL for your tool; check their documentation or support. Create a unique custom webhook for each endpoint you need to deliver to.

Include any required headers for your destination. Sometimes this includes an auth header with a password; check your destination's documentation to confirm.

Choose the event(s) that will trigger your custom messaging and ticketing webhook. Use the form to build the trigger based on multiple filters.

• The most common event used is Issue Change . It covers most needs.
• Other common filters are:

  • Severities: trigger based on an issue severity change
  • Detection: trigger based on a specific detection
• Choose the option to Include events for messages being added / removed / interacted with in a phishing case if you want to also trigger based on individual message level changes (rather than just issue level changes).

---

• While you can include multiple events in one integration, you can only include one of each event type (i.e. one issue change, etc.) All the filters must match to trigger the event. If you need to trigger webhook using OR logic, create multiple integrations with different event parameters.

• Toggle events off/on at any time in the integration view.
• Once your custom SIEM webhook starts firing, the last time an event triggered is included in the integration view, under Events:

1. Add as many events as desired. ( ✅ tip: you can clone events rather than filling out the form each time. Click the copy icon to the right of the event row):

   
2. Integrations are toggled on by default, so if you want to test it first, toggle the integration Off, then save the Integration.
3. Open an event, then click Send Test Event to test your connection. (You need to save the integration first to see this option).

• All webhooks send payloads with the same fields in JSON format. Event Descriptions are in app; click the API icon in the toolbar then click Events.
• Material verifies SSL certificates when delivering payloads.
• Once you have saved the integration, you can click Copy Test Event to view an example payload.

Tool Specific Instructions

Slack Tokens

In Material:

1. Click Integrations (the puzzle icon in the top toolbar).
2. Click Create Integration.
3. Click Slack.
4. Click Create New Integration.

In Slack:

Always review Slack's documentation for up to date instructions.

1. Log in to the Slack apps dashboard and create a new app using a manifest. Our YAML manifest is available at https://[your-material-instance]/api/radar/slack/app_config
2. On the Basic Information page, set the App icon to (optional).
3. On the Install App page, install the app to your workspace.
4. On the Install App page, there should now be a Bot User OAuth Token. Paste this value in Material.

Slack relevant, pre-configured events are enabled by default. Edit or add events as needed. Use the instructions above to complete your integration.

PagerDuty Integration Key

In Material:

1. click Integrations (the puzzle icon in the top toolbar).
2. Click Create Integration.
3. Click PagerDuty.
4. Click Create New Integration.

In PagerDuty:

Always review PagerDuty's documentation for up to date instructions.

Connect Material to PagerDuty using a service integration.

1. Log in to your PagerDuty instance.
2. Navigate to the Service Directory (under the Services tab.)
3. You can create a new service or use an existing one.
4. In the service, click the Integrations tab. Click Add another integration. When it asks which integration you would like to connect, select Events API V2.
5. Once the integration has been created, expanding its card will reveal an Integration Key. Paste this key into Material.

PagerDuty relevant, pre-configured events are enabled by default. Edit or add events as needed. Use the instructions above to complete your integration.

Disable an integration

1. From the Integrations page, open the integration.
2. On the top right, toggle Off.

Event Delivery Behavior

Monitoring and Latency

• Latency, retries, and time-outs

  • For the best experience, your endpoint needs to be able to keep up with incoming webhook events. We automatically retry failed deliveries, but if an endpoint continues to fail, we may disable the associated events. We recommend checking your event subscriptions from time to time to ensure they remain active.
• Deduplication

  • Payloads aren't always deduplicated. It's best practice to implement deduplication logic at your destination.

Troubleshooting

Common Errors

Troubleshooting workflow

1. Check Event Subscription Status: Look for error messages in Material indicating why events might be failing or if subscriptions have been auto-disabled. For example:

   
2. Verify Connectivity: Ensure your tool can receive test events and that Material is set up as an app or similar, if needed (i.e. Slack)
3. Validate Permissions: Ensure your Material account has proper permissions for event subscriptions (Super Admin or Tenant Admin).
4. Check Integration Logs: Look for specific error messages in both Material and your messaging and ticketing platform.