Webhook Notifications

Webhook Notifications

XoloC2 sends real-time alerts to any HTTP webhook endpoint. The payload format is Discord-compatible (rich embeds), and also works with Slack incoming webhooks and any generic HTTP listener.

Step 1 — Get a webhook URL

Discord:

1. Open your server settings → Integrations → Webhooks
2. Click New Webhook, name it (e.g. XoloC2), select a channel
3. Click Copy Webhook URL

Slack:

1. Go to api.slack.com/apps → Create New App → From scratch
2. Enable Incoming Webhooks → Add New Webhook to Workspace
3. Select a channel and copy the webhook URL

Generic: Any URL that accepts a POST with a JSON body works.

Step 2 — Configure in XoloC2

Go to Settings > Notifications.

Paste the webhook URL and toggle Enabled.

Step 3 — Select events

Choose which events trigger a notification:

Event	Description
New agent check-in	A beacon connects for the first time
Operator login	Any successful login to the panel
Failed login	Failed authentication attempt
Agent deleted	A session is deleted from the panel
Task sent	An operator sends a command

Toggle off noisy events (e.g. task_sent) for busy engagements.

Step 4 — Test

Click Send Test Notification. You should receive a test message in your channel within a few seconds. If the delivery fails, check the URL and make sure your webhook is still active.

Notes

• The webhook URL is stored in webhook.json in the XoloC2 directory — protect it like a credential
• Delivery failures are silently ignored — XoloC2 does not retry failed webhooks
• The server must have outbound HTTPS access to reach the webhook endpoint
• Notifications include the agent hostname, IP, OS, and operator username where applicable