Torq

In obserae: create a Webhook output with a signing secret. There is no Torq output type, and none is needed.

1. Trigger: Webhook, secret configured, into a workflow.
2. Step: Utilities → HMAC to verify, then Condition on the result. Torq fails closed if you put the verification after the first HTTP call, so put it first.
3. Step: HTTP Request for GET /api/context/host?ip=…&window=24h&as_of=…. Pass the alert’s fired_at as as_of — otherwise you are reading what the host is doing while you triage, not what it did when the rule fired.
4. Steps for the decision and the ticket.