You can use webhooks to integrate your Tines platform with PhishER. The Tines platform allows you to connect to a REST API or web application and automate your workflows.

With this integration, you can use webhooks to send information from your PhishER console to your Tines platform. For example, you can configure webhooks to notify your Tines platform when a user reports an email using the Phish Alert Button (PAB). You can also configure webhooks to send automatic notifications from a SOAR platform to a communication tool, such as Slack. By using this integration, you can simplify workflows and save time for your organization. For general information about using webhooks in PhishER, visit our Create and Manage Webhooks in Your PhishER Platform article.

Creating Webhooks in Your PhishER Platform

Before you can set up this integration, you'll need to create a webhook in your PhishER console. To create a webhook, follow the steps below:

1. Log in to your PhishER console.
2. Navigate to Settings > Webhook.
3. Click the New Webhook button in the top-right corner of the page to open the Add Webhook Settings page.
4. Fill out the fields on the Add Webhook Settings page. For more information about our recommended settings, see the screenshot and list below:
   1. Name: In this field, enter a meaningful name for your webhook. This name will help your admins recognize the purpose of the webhook.
   2. URL: In this field, enter the callback URL for your webhook.
      Note: If you want to rewrite or shorten the URL, we recommend using one of our compatible rewriters or shorteners. For a list of compatible options, visit our FAQ: PhishER article.
   3. Authorization: From this drop-down menu, select one of the following protocols: No Auth, API Key, Bearer Token, or Basic Auth. We recommend keeping the default setting, which is No Auth.
   4. Available Data: Select one or more types of data that you would like to send to the webhook. We recommend that you select the Raw, Links, Tags, PhishML, and Attachments check boxes.
   5. (Optional) Custom Data: If you want to add custom data to your webhook’s payload, click the plus sign icon. Then, fill out the key and value fields.
   6. (Optional) Custom Headers: If you want to add a custom header, click the plus sign icon. Then, fill out the key and value fields.
   7. Message Tags: We recommend that you select the Success and Failure check boxes if you would like PhishER to assign a tag when the webhook is used to send data. Enter "WEBHOOK_SUCCESS" in the field next to the Success check box. Then, enter "WEBHOOK_FAILURE" in the field next to the Failure check box.
5. Click Create.

After you create the webhook, you can create a PhishER action and select the Send to Webhook option. This option allows PhishER to send the reported messages that are affected by that action to your organization’s webhook.

Connecting to Your Tines Platform

Once you have created a webhook in PhishER, you will need to create an external workflow for the webhook. The steps for creating a workflow will vary depending on the action you want to perform, such as connecting PhishER to Slack using Tines. Example steps for connecting PhishER to Slack are listed below.

1. Create an ingestion point to parse the Webhook payload.
2. Unpack the EML contents from the presigned S3 URL.
3. Run intelligence on email domains, IP addresses, and links. You can use third party and internal threat intel to run the intelligence.
4. Navigate to your Slack workspace and build a custom Slack app using the manifest file template below.
   
   Tip:You can click the image below to view a text file of the manifest text file in a new tab.

5. Copy the Webhook URL from your Slack workspace to point to the Slack channel of your choice.

6. Use Slack's Block Kit to create your Slack notification. For an example, see the screenshot below.
   
   Tip:You can click the image below to view a text file of the manifest text file in a new tab.

7. Send the Intel to your Slack App via HTTPs POST Call.
8. POST Slack Message and the message will be posted to the Slack channel.

Tines Story Example

You can use the .txt file below as a starting point to connecting PhishER to your Tines platform. Once you access the manifest file by clicking the image, you can import the story to the Tines group of your choosing.

For further assistance with this integration, contact our support team.