Child Item

SIEM integration with Webhook

Hello Everyone.

We connected our SIEM to Dropbox with webhook, we sent test message and we received it in the SIEM solution.

But the issue is that we don't see any loges bides test message. We want to receive audit logs and security logs.

Please can anyone advice what should we do in this case we want to continue with webhook but i am not sure what is the issue that we are not receiving any logs.

Thank you ).

Find more posts tagged with

API

Abuse

Comments

DB-Des

Hi @FruitNinja

To clarify, Dropbox webhooks are designed for web apps to receive real-time notifications when a user’s Dropbox content changes. Webhooks don’t send "audit logs" or "security logs", and they won’t produce those kinds of events or messages — they’re specifically for file/content change notifications tied to users linked to your app.

That said, if you are still seeing issues receiving webhook notifications, please review some of the common reasons below:

Have you "linked" or "connected" or "authorized" the app to your account, before making the file changes? Webhook notifications will only be sent for changes in accounts that are connected to the app. When you create a Dropbox API app as a developer, it is not automatically connected to your account as if you were an end-user of the app. You will need to connect to it, as covered in the OAuth guide.
Are you making changes in the same account that you've linked to the app? Similar to the above, make sure you're making changes in the correct account.
If your app is registered for the "app folder" permission, are you making changes in the special app folder created for the app? Webhook notifications will only be sent for changes that the app can access, so Dropbox won't send webhook notifications to an app folder app for changes outside its app folder.
Was your app configured with the "files.metadata.read" scope before you connected it to your account? For scoped apps, webhooks will only be sent for apps authorized with that scope. If you only added that scope after connecting the app to your account, you'll need to re-authorize the app to access your account with that scope enabled.
Are you sure you've properly configured your server to handle webhook notifications at your specified URL? It may be helpful to add some logging along that code path to see where it may be breaking down.