Here you could find examples for JSON documents used by FastNetMon. We maintain official GitHub repository for all our JSON formats.
We use them for web hooks and for JSON-enabled notify script
Blackhole ban action: JSON
Blackhole unban action: JSON
BGP Flow Spec ban action: JSON
BGP Flow Spec unban action: JSON
Per hostgroup (total) ban JSON.
Per hostgroup (total) unban JSON.
To create versatile callback script which works for both per host and per hostgroup actions you can use field “alert_scope” to distinguish them.