Tines integrates directly with AWS Security Hub findings by receiving events sent through Amazon EventBridge. When Security Hub generates or updates a finding, EventBridge routes that JSON payload to a Tines Webhook, where it can be parsed and used to trigger downstream workflows. This allows teams to process findings in near real time using a combination of deterministic steps, human review, and agentic actions.
Security Hub provides the centralized visibility and prioritized insights across AWS environments, while Tines extends that signal into the rest of the security and IT ecosystem. Through Tines, teams can enrich findings with external context, open or update cases, request approvals, notify stakeholders, and orchestrate remediation across AWS as well as third-party systems — without maintaining custom integrations.
Together, Security Hub and Tines enable consistent, repeatable handling of cloud security events from initial detection through full resolution.
Note: You will need the Tines Webhook URL and admin privileges to configure Amazon EventBridge.
Steps
Once you are ready with the Tines Webhook URL, you will:
Create an EventBridge Connection
Create an EventBridge API Destination that uses the Connection
Add a rule to route Security Hub Findings to the API Destination
Create an Event Bridge Connection
Navigate to the Amazon Event Bridge admin console, select Connections, and click Create connection
Enter a name for your connection and select a public API type
For Configure authorization, select Custom configuration, API Key authorization type, enter x-not-used for the API key name, and not-used for the key value
Click Create
Create an EventBridge API Destination
Navigate to the Amazon Event Bridge admin console, select API destinations, and click Create API destination
Enter a name for your API destination, paste the Webhook URL in the API destination endpoint field, and select POST for the HTTP method
Use an existing connection type and select the connection created in the previous step
Click Create
Create an EventBridge Rule
Navigate to the Amazon Event Bridge admin console, select Rules, and click Create rule
Enter a name and click Next
For Events select Other and for Event pattern select Custom pattern (JSON editor)
Paste the following into the JSON editor
{
"source":[
"aws.securityhub"
],
"detail-type":[
"Findings Imported V2"
],
"detail":{
"findings":{
"metadata":{
"product":{
"name":["Security Hub Exposure Detection"]
}
}
}
}
}
This rule routes Security Hub exposure findings. Please see Configuring rules for EventBridge for additional detail.
Click Next
Select EventBridge API destination, use an existing API destination (the one created earlier), and click Skip to Review and create
Scroll to the bottom of the page and click Create rule
Orchestrate and Remediate Security Hub Findings
Security Hub exposure findings will now be sent to the Tines Webhook specified by the API destination. To get started check out the AWS Security Hub Stories in the Tines Library. Note if you change the Tines Webhook URL or add new Webhooks, you will need to update or create new API destinations.