Webhook Notifications

Webhook notifications send JSON payloads to your automation tools whenever a detection finds new events or an investigation is updated. Use them to build SOAR workflows in Tines, N8N, or any platform that accepts HTTP webhooks.

Setup

Add a webhook integration in Settings > Integrations (Tines, N8N, or a custom webhook URL)
Navigate to Settings > Notifications
Toggle Webhook to enable webhook notifications
Select which enrolled webhook providers should receive notifications
Optionally adjust Max events per notification (default: 5,000) to control payload size

tip

Webhooks always fire immediately, even when the frequency mode is set to Batch. The batch frequency only affects email delivery timing.

Detection Webhook Payload

When a detection triggers, Anzenna sends a POST request with the following JSON payload:

{
  "notification": {
    "id": "019cf975-c3fd-7714-85fe-fb8c8986d102",
    "title": "Public Google Workspace Shares: 3 new events",
    "body": "Users sharing documents publicly\n\n3 new events since last notification\n3 events attached\n2 affected users\nsince Mar 17, 2:30 PM",
    "action_url": "https://app.anzenna.ai/u/detections/98fd8ca7-9633-4e0f-8eca-ac3c56b4de97"
  },
  "delivery": {
    "id": "019cf975-c410-7abc-9a12-3456789abcde",
    "recipient_name": "Security Team",
    "channel": "webhook"
  },
  "metadata": {
    "detection_id": "98fd8ca7-9633-4e0f-8eca-ac3c56b4de97",
    "previous_count": 42,
    "current_count": 45,
    "since": 1710612345678,
    "event_count": 3,
    "user_count": 2,
    "affected_users": ["alice@example.com", "bob@example.com"],
    "events": [
      {
        "id": "019a787e-c083-711c-8f3d-4c0c7d61e0ec",
        "person_name": "Alice Smith",
        "description": "Shared document (quarterly-report.xlsx) publicly",
        "timestamp": 1710612300000
      }
    ]
  }
}

Field Reference

Field	Description
`notification.id`	Unique notification ID
`notification.title`	Human-readable title: "{detection}: {N} new events"
`notification.body`	Summary with event count, affected users, and time since last notification
`notification.action_url`	Direct link to the detection in Anzenna
`metadata.detection_id`	Detection ID (use in API calls)
`metadata.previous_count`	Event count at the time of the last notification
`metadata.current_count`	Current event count
`metadata.since`	Unix timestamp (ms) of when the last notification was sent
`metadata.event_count`	Number of new events since last notification
`metadata.user_count`	Number of affected users
`metadata.affected_users`	List of affected user email addresses
`metadata.events`	Array of event summaries (limited by max events per notification setting)

Event Summary Fields

Field	Description
`events[].id`	Event ID — use this to fetch full details via the API
`events[].person_name`	Display name of the person involved
`events[].description`	Human-readable event description
`events[].timestamp`	Unix timestamp (ms) of when the event occurred

Investigation Webhook Payload

When an investigation is completed or updated, Anzenna sends a POST request with the following JSON payload. The key difference from detection webhooks is the use of investigation_metadata instead of metadata.

{
  "notification": {
    "id": "019cf975-d4ae-7714-85fe-ab1c2d3e4f56",
    "title": "Investigation Update: Unusual login pattern detected",
    "body": "Investigation for Alice Smith has been completed\n\nOutcome: Confirmed risk\nRisk score: 8.2",
    "action_url": "https://app.anzenna.ai/u/investigations/b7e2f1a9-4c38-4d12-9a56-1234abcd5678"
  },
  "delivery": {
    "id": "019cf975-d4b0-7abc-9a12-9876fedcba01",
    "recipient_name": "Security Team",
    "channel": "webhook"
  },
  "investigation_metadata": {
    "investigation_id": "b7e2f1a9-4c38-4d12-9a56-1234abcd5678",
    "status": "completed",
    "outcome": "confirmed_risk",
    "headline": "Unusual login pattern detected",
    "person_name": "Alice Smith",
    "person_email": "alice@example.com",
    "detection_name": "Suspicious Login Activity"
  }
}

Investigation Metadata Fields

Field	Description
`investigation_metadata.investigation_id`	Investigation ID (use in API calls)
`investigation_metadata.status`	Current status of the investigation
`investigation_metadata.outcome`	Investigation outcome (e.g. confirmed_risk, no_risk)
`investigation_metadata.headline`	Short description of what was investigated
`investigation_metadata.person_name`	Name of the person under investigation
`investigation_metadata.person_email`	Email of the person under investigation
`investigation_metadata.detection_name`	Name of the detection that triggered this investigation

Distinguishing webhook types

Detection webhooks have a metadata field with event IDs. Investigation webhooks have an investigation_metadata field with an investigation ID. Your automation can route on which field is present — the

Tines starter story

below demonstrates this pattern.

Enriching via the API

Webhook payloads include summaries. To get full details — risk scores, asset names, employee context, AI investigation reports — use the Anzenna API.

Create an API Key

Navigate to Settings > API Keys
Click Create API Key
Grant the Admin scope with Read-only access
Copy the key value — you won't be able to see it again

All API calls require the key in the Authorization header:

Authorization: Bearer <your-api-key>

Get Full Event Details (Detections)

Look up a specific event by its ID from the webhook payload:

curl -X POST https://api.anzenna.ai/api-key/v1/events \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"query": "id = '\''019a787e-c083-711c-8f3d-4c0c7d61e0ec'\''"}'

Example response:

{
  "items": [
    {
      "id": "019a787e-c083-711c-8f3d-4c0c7d61e0ec",
      "issue_type": "direct_sharing_external",
      "employee_email": "alice@example.com",
      "employee_name": "Alice Smith",
      "asset_name": "quarterly-report.xlsx",
      "happened": "2026-03-17T17:48:17.794Z",
      "risk_score": 4.9,
      "source": "google_workspace",
      "high_prevalence": false
    }
  ],
  "pagination": {
    "count": 1
  }
}

Get Investigation Details

Look up an investigation by its ID from the webhook payload:

curl -X GET https://api.anzenna.ai/api-key/v1/investigations/$INVESTIGATION_ID \
  -H "Authorization: Bearer $API_KEY"

The response includes the full investigation report — AI-generated summary, confidence level, recommended action, findings with supporting evidence, person context (role, department, manager), and the detection that triggered it.

Queryable Fields (Events)

Filter events using SQL-like syntax in the query parameter. Combine conditions with AND / OR.

Field	Type	Example
`id`	string	`id = '019a787e-...'`
`employee_email`	string	`employee_email = 'alice@example.com'`
`happened`	timestamp	`happened > '2026-03-01T00:00:00Z'`
`risk_score`	number	`risk_score > 4.0`
`source`	string	`source = 'google_workspace'`
`allowlisted`	boolean	`allowlisted = false`
`high_prevalence`	boolean	`high_prevalence = false`

Other Useful Endpoints

Get detection details:

curl -X GET https://api.anzenna.ai/api-key/v1/detections/{detection_id} \
  -H "Authorization: Bearer $API_KEY"

List all events for a detection:

curl -X POST https://api.anzenna.ai/api-key/v1/detections/{detection_id}/events \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{}'

List affected users:

curl -X GET https://api.anzenna.ai/api-key/v1/detections/{detection_id}/users \
  -H "Authorization: Bearer $API_KEY"

Tines Integration

The starter story below sets up a pipeline that receives Anzenna webhooks, routes them by type (detection or investigation), and enriches them via the API. It handles both notification types in a single story.

                          ┌─ Route: Detection ─── Explode Event IDs ─── Get Detection Details ─── Build Event Summary
Webhook → Extract Fields ─┤
                          └─ Route: Investigation ─── Get Investigation Details ─── Build Investigation Summary

Webhook Action — Receives the Anzenna notification payload
Extract Alert Fields — Parses event IDs from detection webhooks and the investigation ID from investigation webhooks
Route: Detection — Triggers when event_ids is non-empty
Route: Investigation — Triggers when investigation_id is present

The detection path explodes event IDs, fetches full details for each event via the API, and builds a structured summary with overview, user, host, device, and location context. The investigation path fetches the full investigation report including AI-generated summary, confidence level, recommended actions, findings, and evidence.

Download the Tines starter story (JSON)

Setup Instructions

After importing the story into Tines, configure the following:

1. Create a Credential

Go to your Tines tenant > Credentials > New Credential:

Name: anzenna_api_key
Type: Text
Value: Your Anzenna API key (see
Create an API Key

above)

2. Create a Resource

Go to your Tines tenant > Resources > New Resource:

Name: anzenna_api_base_url
Type: Text
Value: https://api.anzenna.ai

3. Connect the Webhook to Anzenna

Copy the webhook URL from the Webhook Action in Tines
In Anzenna, go to Settings > Integrations and add a Tines integration with the webhook URL
Go to Settings > Notifications and enable the Tines integration under Webhook Notifications

Ideas for Extending the Story

Route by severity — Branch on risk_score to handle high, medium, and low risk events differently
Create tickets — Post to Jira or ServiceNow with detection or investigation context
Notify your team — Send to Slack or Teams with the action_url for quick investigation
Auto-remediate — Trigger response actions for high-confidence detections
Escalate investigations — Route confirmed-risk investigations to incident response based on the AI report's recommended action

N8N Integration

The same webhook payload format works with N8N. Set up a Webhook trigger node, then follow the same pattern:

Create a Webhook trigger node in your N8N workflow
Copy the webhook URL and add it as a webhook integration in Anzenna (Settings > Integrations)
Use an IF node to route based on whether metadata.events or investigation_metadata is present
For detections: use a Loop Over Items node to iterate over event IDs, then an HTTP Request node to call the Anzenna events API for full details
For investigations: use an HTTP Request node to call
GET /api-key/v1/investigations/{investigation_id}
for the full report

Need help? Contact

Anzenna Support

for assistance.

Setup​

Detection Webhook Payload​

Field Reference​

Event Summary Fields​

Investigation Webhook Payload​

Investigation Metadata Fields​

Enriching via the API​

Create an API Key​

Get Full Event Details (Detections)​

Get Investigation Details​

Queryable Fields (Events)​

Other Useful Endpoints​

Tines Integration​

Setup Instructions​

Ideas for Extending the Story​

N8N Integration​