You can map alerts to Webhook payload.
{ "type": "Alert", "timestamp": "2022-09-15T10:43:54.131202268-07:00", "severity": "major", "message": "Authentication failed for user \"root\".", "application": "faultmanager", "source_ip": "10.1.1.1", "device_ip": "", "username": "", "message_id": "", "hostname": "tpvm1", "logtype": "", "task": "", "scope": "", "status": "", "sequence_id": 7, "alert_id": 31010, "alarm_id": 0, "resource": "/App/System/Security/Authentication", "alarm_type": "securityOrMechanicalViolation", "alarm_cause": "credentialError", "alert_data": { "username": "root" } }