Test Trend Micro webhooks locally

Start your appCopy Anchor Link

Conformity signs payloads only when you set a Webhook Security Token. The token is optional. With it, Conformity sends the X-TrendMicro-Signature header. The value is the HMAC-SHA256 (a keyed hash) hex digest of the payload body, with your token as the key.

Trend Micro's example hashes JSON.stringify of the parsed body. The handler accepts the digest of the raw body or of the re-serialized body, so it works in both cases. It compares in constant time, as Trend Micro does.

import { createHmac, timingSafeEqual } from "node:crypto";

const hexDigest = (token: string, content: string) =>
  createHmac("sha256", token).update(content).digest("hex");

const matches = (received: string, expected: string) => {
  const receivedBuffer = Buffer.from(received);
  const expectedBuffer = Buffer.from(expected);
  return (
    receivedBuffer.length === expectedBuffer.length &&
    timingSafeEqual(receivedBuffer, expectedBuffer)
  );
};

export async function POST(request: Request) {
  const token = process.env.CONFORMITY_SECURITY_TOKEN;
  if (!token) {
    return new Response("Missing CONFORMITY_SECURITY_TOKEN", { status: 500 });
  }

  const body = await request.text();
  const received = request.headers.get("x-trendmicro-signature") ?? "";

  let reserialized = body;
  try {
    reserialized = JSON.stringify(JSON.parse(body));
  } catch {
    return new Response("Invalid JSON", { status: 400 });
  }

  const isValid =
    matches(received, hexDigest(token, body)) ||
    matches(received, hexDigest(token, reserialized));

  if (!isValid) {
    return new Response("Invalid signature", { status: 401 });
  }

  console.log("Received Conformity notification:", JSON.parse(body));

  return new Response("ok", { status: 200 });
}

Store the token in an environment variable. You choose the token yourself in a later step. Conformity rejects tokens with non-base64 characters.

CONFORMITY_SECURITY_TOKEN=replace-with-your-token

Start the app on port 3000.

npm run dev

Start a tunnelCopy Anchor Link

Use -s with a subdomain you reserved. Without it, the subdomain is random and changes every run, so your webhook would point at a dead URL after a restart. Reserve it first on the Subdomains page. Reserved subdomains are a paid feature, see Pricing.

hrzn tunnel http://localhost:3000 -s my-app

HORIZON: Tunnel connected
  URL          https://my-app.hrzn.run (reserved)
  Forwarding   http://localhost:3000
  Request log  https://hrzn.run/dashboard/tunnels/my-app

Your public URL is https://my-app.hrzn.run. Keep this terminal open. Conformity accepts only https:// URLs, and every Horizon tunnel serves HTTPS.

Add the webhook channel in ConformityCopy Anchor Link

1. In Conformity, go to the Main Dashboard and select your account.
2. Open Settings, then Communication settings.
3. Select Update communication settings and configure Webhook.
4. Select Create a Webhook channel.
5. Enter https://my-app.hrzn.run/api/webhooks/trendmicro as the Webhook URL. Conformity rejects localhost and IP addresses, so use the tunnel URL.
6. Enter the same value as CONFORMITY_SECURITY_TOKEN in Webhook Security Token.
7. Set automatic notifications and configure Triggers.
8. Save the channel. It then appears in your Communication Settings.

Restart npm run dev if you changed .env.local after it started.

Trigger a notificationCopy Anchor Link

Conformity documents no test button and no resend for webhook channels. A notification arrives when one of your triggers fires. Set a broad trigger while you test, then cause that condition in your cloud account.