Breadcrumbs

Pre-configure Tines for Event Logs

Before connecting Tines to Enpass in the Admin Console, you need to create a Story in Tines with a Webhook component to receive incoming events and an Event Transform component to process them. Follow the steps below, then return to Integrate with SIEM Tools to complete the integration.

Step 1: Create a New Story

  1. Log in to your Tines Dashboard.

  2. Click Create a new Story.

  3. Open the newly created Story to begin adding components.

Step 2: Add a Webhook Component

  1. Click Add Component and select Webhook.

  2. Optionally enter a descriptive name for the component.

  3. Set the Path parameter to a recognizable name (e.g., enpass-events-collector). This will be appended to your webhook URL automatically.

  4. Copy the Webhook URL — copy only the base URL with your path. Do not include the secret token that appears after the path in the URL.

  5. Set a Secret Token by replacing the pre-filled value with your own secure string. Save this token — you will need it when configuring the integration in the Enpass Admin Console.

  6. Click + Option and select Access Control.

  7. Set access control to Anyone with the secret.

Note: Tines can pass tokens via URL or via the Authorization header. If the token is included in the URL, the header configuration will be ignored. Use one method consistently.

Step 3: Add an Event Transform Component

  1. Click Add Component and select Event Transform.

  2. Connect it to the Webhook component by dragging a line from the Webhook tile to the Event Transform tile.

  3. Optionally enter a descriptive name for the component.

  4. Configure the following settings:

    • Mode: Explode

    • Path: <<webhook_action.body._json>>

    • To: A key name for the event data in the final JSON output (e.g., event or log)

    • Limit: At least 500 (recommended to handle bulk events from Enpass)

  5. Click Run to activate both components.

Once Enpass begins sending logs, incoming events will appear in the Status and Logs panel on the right side of the Story editor.

Next Step

Return to Integrate with SIEM Tools | Other SIEM Tools (Webhook / JSON) to complete the integration in the Enpass Admin Console.