Skip to main content
Forge can send the same organization notification events used by Slack and email to one HTTPS endpoint. This is useful for SOAR workflows, ticketing systems, and custom security automation. The event toggles and minimum severity under Settings → Ownership apply to the webhook. Owner-specific delivery preferences remain Slack and email only.

​
Set up

  1. Open Settings → Ownership.
  2. In Webhook, select Connect webhook.
  3. Enter a public HTTPS endpoint and save it.
  4. Copy the generated signing secret. Forge shows it only once.
  5. Select Send test and return a 2xx response within five seconds.
  6. After the test succeeds, select Enable.
After setup, the Ownership page shows the webhook as Connected. Select Manage to edit the endpoint, send another test, enable or disable delivery, or regenerate the signing secret. Changing the endpoint or regenerating the secret disables delivery until the new configuration passes a test.

​
Request

Forge sends one notification per request:
owner is included only when the notification has an ownership target. Forge does not include prompts, tool inputs, tool outputs, raw provider events, or arbitrary internal metadata in this payload.

​
Verify signatures

Requests include: Compute HMAC-SHA256 over <timestamp>.<raw request body> using the signing secret, then compare it to X-Forge-Webhook-Signature with a constant-time comparison. Reject stale timestamps and process repeated webhook IDs idempotently. Forge does not follow redirects. Network errors, timeouts, 408, 429, and 5xx responses are retried up to three attempts. Any 2xx response succeeds; other responses fail permanently.

​
Tines

Use a Tines Webhook action as the Forge destination. In the receiving Story:
  1. Use id as the deduplication key.
  2. Branch on type and severity.
  3. Use subject.type and subject.id for enrichment or ticket correlation.
  4. Include forgeUrl in analyst notifications and cases.
The webhook delivery history in Forge shows attempts and safe error details. Replay a failed delivery from Settings → Ownership after correcting the Story or receiver.

​
Google Security Operations SOAR

Google SecOps SOAR accepts arbitrary JSON through an incoming webhook and maps it to alert fields. Upload the Forge payload above as the JSON sample, then use these minimum mappings: Keep DisplayId unique so Google SecOps can deduplicate alerts. Test and enable the mapping in SOAR Settings → Ingestion → Webhooks. Google recommends a webhook for basic mapping and a connector only when advanced, source-specific mapping is required. See Set up a SOAR webhook. This notification webhook creates workflow alerts and cases. For continuous, searchable security telemetry, use Security Exports instead.

​
Other HTTPS receivers

Any receiver that accepts HTTPS JSON can use this integration. Preserve id for idempotency, verify the signature before processing, return 2xx only after accepting the event, and use forgeUrl to send analysts back to the source record.