I investigated this earlier (Custom HTTP Notification -> DFIR-IRIS) but got nowhere. Honestly, I’ve had a lot of trouble using Graylog’s Custom HTTP notifications. For instance, I can’t even get it to work with Gotify (which you would think would be fairly straight forward).
C’est la vie