Send results to your SIEM or LMS

A campaign can post each call result to a URL you own. The wizard says: “When a person is compromised or resists, we POST the result here so your SIEM, SOAR or training platform can act on it. HTTPS only.” Use it to open a ticket, enrol a person in training, or keep your own record.

Requests are not signed. There is no signature header to verify. Protect the endpoint yourself: put a secret in the URL path or query, or accept requests only from DeepBlocker’s addresses.

Before you start

An HTTPS endpoint on a public address that accepts a JSON POST and replies within 10 seconds.
A campaign on its last wizard step, or a template you want to carry the URL.

Steps

Open the advanced field

On the Authorise and launch step, under Name this campaign, click Advanced: send results to a webhook. A Webhook URL field appears.

Enter the URL

Paste the address, for example https://your-siem-or-lms.example.com/hook?key=.... It must start with https:// and resolve to a public address. A private or internal address is refused silently and nothing is sent.

Launch

Record the authorisation and click Launch. The URL is saved with the campaign, and with any template made from it. See Authorise and launch.

When it fires

Rule	Detail
Which calls	Calls that ended Failed or Passed, that is, a person answered and talked
Which calls do not fire	No answer, voicemail, call failed. A Reported result does not fire
How many times	Once per call, on the first delivery of the call’s result
When	After the call ends and the live detector verdict, if any, is on the record. A verdict that lands later is not re-sent
Timeout	10 seconds
Retries	None. A failed delivery is logged on our side and not retried
Method and headers	`POST`, `Content-Type: application/json`, `User-Agent: DeepBlocker-RedTeam/1.0`

The payload

The body is one JSON object. Fields marked optional are left out when there is nothing to send.

Field	Type	What it holds
`event`	string	Always `redteam.call.result`
`campaignId`	string	The campaign
`campaignName`	string, optional	The campaign’s name
`contactId`	string, optional	The person’s id on your People list
`contactName`	string, optional	The person’s name
`outcome`	string	`compromised` or `resisted`
`riskScore`	number, optional	The analysis risk score, 0 to 100
`informationDisclosed`	array of strings, optional	What the person gave away
`occurredAt`	string	When the call ended, ISO 8601
`defenseVerdict`	object	Our detector’s result on this call, below
`campaignSummary`	object	The campaign’s numbers at send time, below

`defenseVerdict`

Field	Type	What it holds
`state`	string	`caught`, `missed` or `not_scored`. See The “detector caught” column
`fakeProbability`	number, optional	0 to 1, how synthetic the voice scored. Present when scored
`threshold`	number, optional	0 to 1, the score at or above which the detector blocks. Present when scored
`modelName`	string, optional	The detector model
`source`	string, optional	`vapi` or `livekit` for a recording scored after the call, `live` for the live detector on a protected line

`campaignSummary`

Counts are per person, with retries collapsed. They move as more calls finish, so keep the latest event per campaign rather than adding events up.

Field	Type	What it holds
`reached`	number	People who answered and talked
`gaveAway`	number	People who gave something away
`reported`	number	People who reported the call
`blocked`	number	Calls the detector would have blocked
`residual`	number	People who failed on a call the detector missed
`scored`	number	Calls with a detector verdict
`unscoredFailures`	number	Failed calls with no verdict yet
`staffFailurePct`	number	`gaveAway` out of `reached`, as a percentage
`detectorCatchPct`	number or null	Of the failed calls with a score, the share the detector would have blocked. `null` until one failed call is scored
`residualPct`	number	`residual` out of `reached`
`sentence`	string	The one-line summary the console shows

Example

{
  "event": "redteam.call.result",
  "campaignId": "c_8f2a1b",
  "campaignName": "Finance desk, November",
  "contactId": "ct_41d9",
  "contactName": "Sam Patel",
  "outcome": "compromised",
  "riskScore": 82,
  "informationDisclosed": ["Employee ID", "Manager's name"],
  "occurredAt": "2026-11-10T10:42:17.000Z",
  "defenseVerdict": {
    "state": "caught",
    "fakeProbability": 0.93,
    "threshold": 0.8,
    "modelName": "v7",
    "source": "livekit"
  },
  "campaignSummary": {
    "reached": 12,
    "gaveAway": 3,
    "reported": 1,
    "blocked": 2,
    "residual": 1,
    "scored": 11,
    "unscoredFailures": 0,
    "staffFailurePct": 25,
    "detectorCatchPct": 67,
    "residualPct": 8,
    "sentence": "25% of staff gave something away. 8% reported the call. Our detector would have blocked 67% of those calls before a person picked up. Residual exposure: 8%."
  }
}

What happens next

Your endpoint receives one event per answered call as the campaign runs. Reply with any 2xx status. There is nothing to acknowledge beyond that.

Names are sent in contactName whatever your Show names in reports setting is. If your endpoint should not hold names, leave contactName unused on your side.

Problems

Nothing arrives

Check the URL starts with https:// and points at a public address. Check your endpoint answers within 10 seconds. Only calls that ended Failed or Passed fire.

A call fired once and never again

That is by design. Each call fires once. A detector verdict that lands later is carried in the next event’s campaignSummary.

Someone could post fake results to my endpoint

Yes, because the request is not signed. Put a secret in the URL, restrict by source, and treat the data as a trigger to look at the console, not as the record itself.

Understand the product

Set up

Run a campaign

While it runs

Results and reports

Licence and minutes

Messages your staff receive

Problems

Send results to your SIEM or LMS

Before you start

Steps

When it fires

The payload

`defenseVerdict`

`campaignSummary`

Example

What happens next

Problems

​Before you start

​Steps

​When it fires

​The payload

​defenseVerdict

​campaignSummary

​Example

​What happens next

​Problems

Before you start

Steps

When it fires

The payload

`defenseVerdict`

`campaignSummary`

Example

What happens next

Problems