{
  "schema_version": 30,
  "standard_lib_version": 90,
  "action_runtime_version": 77,
  "name": "Anzenna Events API - Rich Event Details Demo",
  "description": null,
  "guid": "f98dd638cf4d0a31b19d05468d18e1c5",
  "slug": "anzenna_events_api_rich_event_details_demo",
  "agents": [
    {
      "type": "Agents::WebhookAgent",
      "name": "Webhook Action",
      "disabled": false,
      "description": null,
      "guid": "e9816c831c842d75edc89ab7563d0295",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:45b15b5b9c95bc9218099e2b68983597",
      "options": {
        "path": "anzenna-webhook",
        "secret": "REPLACE_WITH_YOUR_WEBHOOK_SECRET",
        "verbs": "get,post"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null
    },
    {
      "type": "Agents::EventTransformationAgent",
      "name": "Extract Alert Fields",
      "disabled": false,
      "description": "Extracts event IDs from detection webhooks and investigation ID from investigation webhooks",
      "guid": "de8c58ea0cbf235344256da3805d5a08",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:9f3c5923d1a67eaf5ade4bcdf75b6996",
      "options": {
        "mode": "automatic",
        "input": "=webhook_action",
        "language": "python_3_13",
        "script": "def main(input: dict) -> dict:\n    body = input.get(\"body\", {})\n\n    # Detection webhooks carry event IDs in metadata.events\n    events = body.get(\"metadata\", {}).get(\"events\", [])\n    event_ids = [event.get(\"id\") for event in events]\n\n    # Investigation webhooks carry investigation_id in investigation_metadata\n    inv_meta = body.get(\"investigation_metadata\", {})\n    investigation_id = inv_meta.get(\"investigation_id\", \"\")\n\n    return {\n        \"event_ids\": event_ids,\n        \"investigation_id\": investigation_id,\n    }"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null,
      "schedule": null
    },
    {
      "type": "Agents::EventTransformationAgent",
      "name": "Explode Event IDs",
      "disabled": false,
      "description": "Splits event_ids array into individual events",
      "guid": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:9f3c5923d1a67eaf5ade4bcdf75b6996",
      "options": {
        "mode": "explode",
        "path": "=extract_alert_fields.output.event_ids",
        "to": "individual_event"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null,
      "schedule": null
    },
    {
      "type": "Agents::HTTPRequestAgent",
      "name": "Get Detection Details",
      "disabled": false,
      "description": null,
      "guid": "e73ec3934ee797b282f6d40cc121e653",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:9f3c5923d1a67eaf5ade4bcdf75b6996",
      "options": {
        "url": "<<RESOURCE.anzenna_api_base_url>>/api-key/v1/events",
        "content_type": "application_json",
        "method": "post",
        "headers": {
          "Authorization": "Bearer <<CREDENTIAL.anzenna_api_key>>"
        },
        "log_error_on_status": [],
        "payload": {
          "query": "id = '<<explode_event_ids.individual_event>>'"
        }
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null,
      "schedule": null
    },
    {
      "type": "Agents::EventTransformationAgent",
      "name": "Build Event Summary",
      "disabled": false,
      "description": "Extracts employee, device, host, and location from the API response — the same data visible in the UI's Overview/User/Host/Device/Location tabs",
      "guid": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d7e8",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:45b15b5b9c95bc9218099e2b68983597",
      "options": {
        "mode": "automatic",
        "input": "=get_detection_details",
        "language": "python_3_13",
        "script": "def main(input: dict) -> dict:\n    event = (input.get(\"body\", {}).get(\"items\") or [{}])[0]\n\n    employee = event.get(\"employee\") or {}\n    device = event.get(\"device\") or {}\n    web_host = event.get(\"web_host\") or {}\n    network = event.get(\"network_origin\") or {}\n    geo = network.get(\"geographic_location\") or {}\n    net_info = network.get(\"network\") or {}\n    privacy = network.get(\"privacy\") or {}\n\n    return {\n        \"overview\": {\n            \"event_id\": event.get(\"id\"),\n            \"event_type\": event.get(\"event_type\"),\n            \"happened\": event.get(\"happened\"),\n            \"source\": event.get(\"source\"),\n            \"risk_score\": event.get(\"risk_score\"),\n            \"description\": event.get(\"description\"),\n            \"allowlisted\": event.get(\"allowlisted\"),\n            \"high_prevalence\": event.get(\"high_prevalence\"),\n            \"asset_name\": event.get(\"asset_name\"),\n        },\n        \"user\": {\n            \"name\": employee.get(\"name\"),\n            \"email\": employee.get(\"email\"),\n            \"job_title\": employee.get(\"job_title\"),\n            \"department\": employee.get(\"department\"),\n            \"manager_name\": employee.get(\"manager_name\"),\n            \"manager_email\": employee.get(\"manager_email\"),\n            \"state\": employee.get(\"state\"),\n            \"location\": \", \".join(filter(None, [\n                employee.get(\"location_city\"),\n                employee.get(\"location_state\"),\n                employee.get(\"location_country\"),\n            ])),\n            \"risk_score\": employee.get(\"risk_score\"),\n            \"last_login\": employee.get(\"last_login\"),\n        },\n        \"host\": {\n            \"hostname\": web_host.get(\"host\"),\n            \"last_seen\": web_host.get(\"last_seen\"),\n            \"login_count\": web_host.get(\"login_count\"),\n            \"risk_score\": web_host.get(\"risk_score\"),\n            \"event_types\": web_host.get(\"event_types\"),\n            \"allowlisted\": web_host.get(\"allowlisted\"),\n        },\n        \"device\": {\n            \"name\": device.get(\"name\"),\n            \"serial_number\": device.get(\"serial_number\"),\n            \"platform\": device.get(\"platform\"),\n            \"model\": device.get(\"model\"),\n            \"disk_encryption\": device.get(\"disk_encryption\"),\n            \"antivirus\": device.get(\"antivirus\"),\n            \"mdm\": device.get(\"mdm\"),\n            \"last_seen\": device.get(\"last_seen\"),\n            \"apps_installed\": device.get(\"apps_installed\"),\n        },\n        \"location\": {\n            \"ip_address\": network.get(\"ip\"),\n            \"country\": geo.get(\"country\"),\n            \"region\": geo.get(\"region\"),\n            \"city\": geo.get(\"city\"),\n            \"latitude\": geo.get(\"latitude\"),\n            \"longitude\": geo.get(\"longitude\"),\n            \"timezone\": geo.get(\"timezone\"),\n            \"asn\": net_info.get(\"asn\"),\n            \"asn_name\": net_info.get(\"asn_name\"),\n            \"host_type\": net_info.get(\"host_type\"),\n            \"privacy_mode\": privacy.get(\"privacy_mode\"),\n            \"vpn_service\": privacy.get(\"service_name\"),\n        },\n    }"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null,
      "schedule": null
    },
    {
      "type": "Agents::TriggerAgent",
      "name": "Route: Detection",
      "disabled": false,
      "description": "Routes to the detection path when the webhook contains event IDs",
      "guid": "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:45b15b5b9c95bc9218099e2b68983597",
      "options": {
        "rules": [
          {
            "type": "field>value",
            "value": "0",
            "path": "<<extract_alert_fields.output.event_ids.size>>"
          }
        ]
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null
    },
    {
      "type": "Agents::TriggerAgent",
      "name": "Route: Investigation",
      "disabled": false,
      "description": "Routes to the investigation path when the webhook contains an investigation ID",
      "guid": "a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:45b15b5b9c95bc9218099e2b68983597",
      "options": {
        "rules": [
          {
            "type": "regex",
            "value": ".+",
            "path": "<<extract_alert_fields.output.investigation_id>>"
          }
        ]
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null
    },
    {
      "type": "Agents::HTTPRequestAgent",
      "name": "Get Investigation Details",
      "disabled": false,
      "description": "Fetches full investigation details including AI report, person context, and evidence",
      "guid": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:45b15b5b9c95bc9218099e2b68983597",
      "options": {
        "url": "<<RESOURCE.anzenna_api_base_url>>/api-key/v1/investigations/<<extract_alert_fields.output.investigation_id>>",
        "content_type": "application_json",
        "method": "get",
        "headers": {
          "Authorization": "Bearer <<CREDENTIAL.anzenna_api_key>>"
        },
        "log_error_on_status": []
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null,
      "schedule": null
    },
    {
      "type": "Agents::EventTransformationAgent",
      "name": "Build Investigation Summary",
      "disabled": false,
      "description": "Extracts investigation outcome, AI report, person context, detection context, and evidence from the API response",
      "guid": "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9",
      "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:45b15b5b9c95bc9218099e2b68983597",
      "options": {
        "mode": "automatic",
        "input": "=get_investigation_details",
        "language": "python_3_13",
        "script": "def main(input: dict) -> dict:\n    inv = input.get(\"body\", {})\n    report = inv.get(\"report\") or {}\n    person = inv.get(\"person\") or {}\n    detection = inv.get(\"detection\") or {}\n    evidence_list = inv.get(\"evidence\") or []\n\n    notes = report.get(\"notes\") or []\n    findings = [\n        {\n            \"summary\": n.get(\"summary\"),\n            \"event_query\": n.get(\"event_query\"),\n            \"event_count\": len(n.get(\"event_refs\") or []),\n        }\n        for n in notes\n    ]\n\n    evidence = [\n        {\n            \"event_id\": e.get(\"event_id\"),\n            \"event_type\": e.get(\"event_type\"),\n            \"happened\": e.get(\"happened\"),\n            \"description\": e.get(\"description\"),\n            \"risk_score\": e.get(\"risk_score\"),\n            \"source\": e.get(\"source\"),\n            \"asset_name\": e.get(\"asset_name\"),\n            \"note_summary\": e.get(\"note_summary\"),\n        }\n        for e in evidence_list\n    ]\n\n    return {\n        \"investigation\": {\n            \"id\": inv.get(\"id\"),\n            \"status\": inv.get(\"status\"),\n            \"outcome\": inv.get(\"outcome\"),\n            \"risk_score\": inv.get(\"risk_score\"),\n            \"headline\": inv.get(\"headline\"),\n            \"created\": inv.get(\"created\"),\n            \"updated\": inv.get(\"updated\"),\n        },\n        \"report\": {\n            \"summary\": report.get(\"summary\"),\n            \"confidence_level\": report.get(\"confidence_level\"),\n            \"recommended_action\": report.get(\"recommended_action\"),\n            \"findings\": findings,\n        },\n        \"person\": {\n            \"name\": person.get(\"name\"),\n            \"email\": person.get(\"email\"),\n            \"job_title\": person.get(\"job_title\"),\n            \"department\": person.get(\"department\"),\n            \"manager_name\": person.get(\"manager_name\"),\n            \"manager_email\": person.get(\"manager_email\"),\n            \"location\": person.get(\"location\"),\n            \"risk_score\": person.get(\"risk_score\"),\n        },\n        \"detection\": {\n            \"name\": detection.get(\"name\"),\n            \"kind\": detection.get(\"kind\"),\n            \"event_count\": detection.get(\"event_count\"),\n            \"user_count\": detection.get(\"user_count\"),\n        },\n        \"evidence\": evidence,\n    }"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "template": {
        "created_from_template_guid": null,
        "created_from_template_version": null,
        "template_tags": []
      },
      "width": null,
      "schedule": null
    }
  ],
  "diagram_notes": [],
  "links": [
    {
      "source": 0,
      "receiver": 1
    },
    {
      "source": 1,
      "receiver": 5
    },
    {
      "source": 1,
      "receiver": 6
    },
    {
      "source": 2,
      "receiver": 3
    },
    {
      "source": 3,
      "receiver": 4
    },
    {
      "source": 5,
      "receiver": 2
    },
    {
      "source": 6,
      "receiver": 7
    },
    {
      "source": 7,
      "receiver": 8
    }
  ],
  "diagram_layout": "{\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\":[-345,1170],\"a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2\":[45,1080],\"b2c3d4e5f6a7b8c9d0e1f2a3b4c5d7e8\":[-345,1350],\"c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8\":[45,1170],\"d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9\":[45,1260],\"de8c58ea0cbf235344256da3805d5a08\":[-150,990],\"e73ec3934ee797b282f6d40cc121e653\":[-345,1260],\"e9816c831c842d75edc89ab7563d0295\":[-150,900],\"f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6\":[-345,1080]}",
  "story_library_metadata": {},
  "monitor_failures": false,
  "synchronous_webhooks_enabled": false,
  "integrations": [],
  "sections": [],
  "parent_only_send_to_story": false,
  "send_to_story_timeout_enabled": false,
  "send_to_story_timeout_duration_seconds": null,
  "keep_events_for": 86400,
  "reporting_status": true,
  "send_to_story_enabled": false,
  "entry_agent_guid": null,
  "exit_agent_guids": [],
  "api_entry_action_guids": [],
  "api_exit_action_guids": [],
  "send_to_story_access": null,
  "send_to_story_access_source": 0,
  "send_to_story_skill_use_requires_confirmation": true,
  "pages": [],
  "tags": [],
  "time_saved_unit": "minutes",
  "time_saved_value": 0,
  "origin_story_identifier": "cloud:c71bf32822fac909e32c41fabb534a8a:45b15b5b9c95bc9218099e2b68983597",
  "recipients": [],
  "integration_product": null,
  "integration_vendor": null,
  "llm_product_instructions": "",
  "start_reference": null,
  "app_endpoints": [],
  "send_to_stories": [],
  "exported_at": "2026-06-02T14:35:41Z",
  "icon": ":yarn:"
}