Webhook Notifications

Webhook notifications send JSON payloads to your automation tools whenever a detection finds new events or an investigation is updated. Use them to build SOAR workflows in Tines, N8N, or any platform that accepts HTTP webhooks.

Setup

Add a webhook integration in Settings > Integrations (Tines, N8N, or a custom webhook URL)
Navigate to Settings > Notifications
Toggle Webhook to enable webhook notifications
Select which enrolled webhook providers should receive notifications
Optionally adjust Max events per notification (default: 5,000) to control payload size

tip

Webhooks always fire immediately, even when the frequency mode is set to Batch. The batch frequency only affects email delivery timing.

Detection Webhook Payload

When a detection triggers, Anzenna sends a POST request with the following JSON payload:

{
  "notification": {
    "id": "019cf975-c3fd-7714-85fe-fb8c8986d102",
    "title": "Public Google Workspace Shares: 3 new events",
    "body": "Users sharing documents publicly\n\n3 new events since last notification\n3 events attached\n2 affected users\nsince Mar 17, 2:30 PM",
    "action_url": "https://app.anzenna.ai/u/detections/98fd8ca7-9633-4e0f-8eca-ac3c56b4de97"
  },
  "delivery": {
    "id": "019cf975-c410-7abc-9a12-3456789abcde",
    "recipient_name": "Security Team",
    "channel": "webhook"
  },
  "metadata": {
    "detection_id": "98fd8ca7-9633-4e0f-8eca-ac3c56b4de97",
    "previous_count": 42,
    "current_count": 45,
    "since": 1710612345678,
    "event_count": 3,
    "user_count": 2,
    "affected_users": ["alice@example.com", "bob@example.com"],
    "events": [
      {
        "id": "019a787e-c083-711c-8f3d-4c0c7d61e0ec",
        "person_name": "Alice Smith",
        "description": "Shared document (quarterly-report.xlsx) publicly",
        "timestamp": 1710612300000
      }
    ]
  }
}

Field Reference

Field	Description
`notification.id`	Unique notification ID
`notification.title`	Human-readable title: "{detection}: {N} new events"
`notification.body`	Summary with event count, affected users, and time since last notification
`notification.action_url`	Direct link to the detection in Anzenna
`metadata.detection_id`	Detection ID (use in API calls)
`metadata.previous_count`	Event count at the time of the last notification
`metadata.current_count`	Current event count
`metadata.since`	Unix timestamp (ms) of when the last notification was sent
`metadata.event_count`	Number of new events since last notification
`metadata.user_count`	Number of affected users
`metadata.affected_users`	List of affected user email addresses
`metadata.events`	Array of event summaries (limited by max events per notification setting)

Event Summary Fields

Field	Description
`events[].id`	Event ID, use this to fetch full details via the API
`events[].person_name`	Display name of the person involved
`events[].description`	Human-readable event description
`events[].timestamp`	Unix timestamp (ms) of when the event occurred

Investigation Webhook Payload

When an investigation is completed or updated, Anzenna sends a POST request with the following JSON payload. The key difference from detection webhooks is the use of investigation_metadata instead of metadata.

{
  "notification": {
    "id": "019cf975-d4ae-7714-85fe-ab1c2d3e4f56",
    "title": "Investigation Update: Unusual login pattern detected",
    "body": "Investigation for Alice Smith has been completed\n\nOutcome: Confirmed risk\nRisk score: 8.2",
    "action_url": "https://app.anzenna.ai/u/investigations/b7e2f1a9-4c38-4d12-9a56-1234abcd5678"
  },
  "delivery": {
    "id": "019cf975-d4b0-7abc-9a12-9876fedcba01",
    "recipient_name": "Security Team",
    "channel": "webhook"
  },
  "investigation_metadata": {
    "investigation_id": "b7e2f1a9-4c38-4d12-9a56-1234abcd5678",
    "status": "completed",
    "outcome": "confirmed_risk",
    "headline": "Unusual login pattern detected",
    "person_name": "Alice Smith",
    "person_email": "alice@example.com",
    "detection_name": "Suspicious Login Activity"
  }
}

Investigation Metadata Fields

Field	Description
`investigation_metadata.investigation_id`	Investigation ID (use in API calls)
`investigation_metadata.status`	Current status of the investigation
`investigation_metadata.outcome`	Investigation outcome (e.g. confirmed_risk, no_risk)
`investigation_metadata.headline`	Short description of what was investigated
`investigation_metadata.person_name`	Name of the person under investigation
`investigation_metadata.person_email`	Email of the person under investigation
`investigation_metadata.detection_name`	Name of the detection that triggered this investigation

Distinguishing webhook types

Detection webhooks have a metadata field with event IDs. Investigation webhooks have an investigation_metadata field with an investigation ID. Your automation can route on which field is present. The

Tines starter story

below demonstrates this pattern.

Enriching via the API

Webhook payloads include summaries. To get full details (risk scores, asset names, employee context, AI investigation reports), use the Anzenna API.

Create an API Key

Navigate to Settings > API Keys
Click Create API Key
Grant the Admin scope with Read-only access
Copy the key value. You won't be able to see it again

All API calls require the key in the Authorization header:

Authorization: Bearer <your-api-key>

Get Full Event Details (Detections)

Look up a specific event by its ID from the webhook payload:

curl -X POST https://api.anzenna.ai/api-key/v1/events \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"query": "id = '\''019a787e-c083-711c-8f3d-4c0c7d61e0ec'\''"}'

Example response:

{
  "items": [
    {
      "id": "019a787e-c083-711c-8f3d-4c0c7d61e0ec",
      "issue_type": "direct_sharing_external",
      "employee_email": "alice@example.com",
      "employee_name": "Alice Smith",
      "asset_name": "quarterly-report.xlsx",
      "happened": "2026-03-17T17:48:17.794Z",
      "risk_score": 4.9,
      "source": "google_workspace",
      "high_prevalence": false
    }
  ],
  "pagination": {
    "count": 1
  }
}

Get Investigation Details

Look up an investigation by its ID from the webhook payload:

curl -X GET https://api.anzenna.ai/api-key/v1/investigations/$INVESTIGATION_ID \
  -H "Authorization: Bearer $API_KEY"

The response includes the full investigation report: AI-generated summary, confidence level, recommended action, findings with supporting evidence, person context (role, department, manager), and the detection that triggered it.

Queryable Fields (Events)

Filter events using SQL-like syntax in the query parameter. Combine conditions with AND / OR.

Field	Type	Example
`id`	string	`id = '019a787e-...'`
`employee_email`	string	`employee_email = 'alice@example.com'`
`happened`	timestamp	`happened > '2026-03-01T00:00:00Z'`
`risk_score`	number	`risk_score > 4.0`
`source`	string	`source = 'google_workspace'`
`allowlisted`	boolean	`allowlisted = false`
`high_prevalence`	boolean	`high_prevalence = false`

Other Useful Endpoints

Get detection details:

curl -X GET https://api.anzenna.ai/api-key/v1/detections/{detection_id} \
  -H "Authorization: Bearer $API_KEY"

List all events for a detection:

curl -X POST https://api.anzenna.ai/api-key/v1/detections/{detection_id}/events \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{}'

List affected users:

curl -X GET https://api.anzenna.ai/api-key/v1/detections/{detection_id}/users \
  -H "Authorization: Bearer $API_KEY"

Tines Integration

The starter story below sets up a pipeline that receives Anzenna webhooks, routes them by type (detection or investigation), and enriches them via the API. It handles both notification types in a single story.

                          ┌─ Route: Detection ─── Explode Event IDs ─── Get Detection Details ─── Build Event Summary
Webhook → Extract Fields ─┤
                          └─ Route: Investigation ─── Get Investigation Details ─── Build Investigation Summary

Webhook Action: Receives the Anzenna notification payload
Extract Alert Fields: Parses event IDs from detection webhooks and the investigation ID from investigation webhooks
Route: Detection. Triggers when event_ids is non-empty
Route: Investigation. Triggers when investigation_id is present

The detection path explodes event IDs, fetches full details for each event via the API, and builds a structured summary with overview, user, host, device, and location context. The investigation path fetches the full investigation report including AI-generated summary, confidence level, recommended actions, findings, and evidence.

Download the Tines starter story (JSON)

Setup Instructions

After importing the story into Tines, configure the following:

1. Create a Credential

Go to your Tines tenant > Credentials > New Credential:

Name: anzenna_api_key
Type: Text
Value: Your Anzenna API key (see
Create an API Key

above)

2. Create a Resource

Go to your Tines tenant > Resources > New Resource:

Name: anzenna_api_base_url
Type: Text
Value: https://api.anzenna.ai

3. Connect the Webhook to Anzenna

Copy the webhook URL from the Webhook Action in Tines
In Anzenna, go to Settings > Integrations and add a Tines integration with the webhook URL
Go to Settings > Notifications and enable the Tines integration under Webhook Notifications

Ideas for Extending the Story

Route by severity: Branch on risk_score to handle high, medium, and low risk events differently
Create tickets: Post to Jira or ServiceNow with detection or investigation context
Notify your team: Send to Slack or Teams with the action_url for quick investigation
Auto-remediate: Trigger response actions for high-confidence detections
Escalate investigations: Route confirmed-risk investigations to incident response based on the AI report's recommended action

N8N Integration

The same webhook payload format works with N8N. Set up a Webhook trigger node, then follow the same pattern:

Create a Webhook trigger node in your N8N workflow
Copy the webhook URL and add it as a webhook integration in Anzenna ( Settings > Integrations)
Use an IF node to route based on whether metadata.events or investigation_metadata is present
For detections: use a Loop Over Items node to iterate over event IDs, then an HTTP Request node to call the Anzenna events API for full details
For investigations: use an HTTP Request node to call
GET /api-key/v1/investigations/{investigation_id}
for the full report

Need help? Contact

Anzenna Support

for assistance.

Setup​

Detection Webhook Payload​

Field Reference​

Event Summary Fields​

Investigation Webhook Payload​

Investigation Metadata Fields​

Enriching via the API​

Create an API Key​

Get Full Event Details (Detections)​

Get Investigation Details​

Queryable Fields (Events)​

Other Useful Endpoints​

Tines Integration​

Setup Instructions​

Ideas for Extending the Story​

N8N Integration​