Hi @yzaritskyi, we use the webhook action on our internal SIEM to send the entire contents of the alert to our SOAR system. Instead of a json content type we set it to ndjson. This is the header we add to our webhook connector:
If you want to send the entire alert context to your SOAR this is the body of the Connector Action:
This will send all alerts that triggered during the last rule execution as a single ndjson file to your SOAR so you will need to split them apart after they are sent through the webhook.