Use Event History and your webhook receiver logs to diagnose delivery failures. Do not share the HMAC secret while troubleshooting.
This feature is available through Early Access. Enable on the Administration > Early Access Features page to access it.
Confirm that an event is expected
BloodHound Enterprise triggers Collector Offline only after a collector has not checked in for at least 20 minutes. It evaluates collector status about every seven minutes, so delivery normally begins about 20 to 27 minutes after the last check-in. BloodHound Enterprise sends at most one Collector Offline event trigger for each collector during a seven-day cooldown. It does not send a recovery event when that collector checks in again.Review Event History
Go to Administration > Alerts > Event History, then search for the event ID or open View Event History from the webhook actions menu. Use the delivery information to identify where the failure occurred:
Use the delivery attempt API to locate an attempt, then use the retry attempt API to requeue a failed delivery. BloodHound Enterprise does not currently store the receiver’s HTTP status code for production deliveries; use the last error and receiver logs instead.
Interpret test results
Use Run Test from the webhook actions menu to send a sample alert event without waiting for a collector to become offline. A test failure reports a delivery error. When the receiver returns an HTTP response, the test webhook API also returns its status code. Network and TLS failures do not have a receiver status code.Tests do not create Event History records, increment delivery attempts, or affect webhook health. Correct the receiver configuration, then run the test again.