Civicrm has a built-in layer of intrusion detection using a library called PHPIDS. Unfortunately, I often have to disable for webhooks and other things that get trapped. For example, using the mandrill extension, the system flags the webhook as an intrusion.
I'm sure there is a way to hack/patch the code, but is an IDS configuration profile supported somehow? I couldn't find any documentation.