Skip to main content
Last updated on

Tines

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Export Lakewatch alerts to a Tines story. When an alert is created, Lakewatch posts a JSON event to a Tines webhook, and your Tines story decides what happens with it. For how export behaves across destinations, see Alert destinations.

Export to Tines is one-way, from Lakewatch to Tines. Lakewatch sends the event through a Tines webhook action, authenticating with a webhook secret that you store as a Unity Catalog secret.

How the event is delivered​

  • On alert creation: Lakewatch posts a JSON event with the event_type lakewatch.alert.created. The payload uses the same schema and field names as the generic webhook destination, so a Tines story can read the same fields.
  • On alert updates: when update delivery is enabled for the destination, Lakewatch also posts a lakewatch.alert.updated event for later changes to an already-exported alert. To enable update delivery, see Configure settings.
  • Your story decides the outcome: Lakewatch hands the event to your Tines story. A 2xx response means Tines accepted the event, not that your story acted on it. If Lakewatch reports a successful export but nothing happens in Tines, check your story logic rather than the export configuration.
warning

Delivery is at-most-once. If a POST to Tines fails, Lakewatch records the failure but does not retry, and the event is not resent. The alert is still created in Lakewatch.

To avoid processing the same alert twice, correlate events in your Tines story on the data.alert_id field. Do not de-duplicate on delivery_attempt_id, which is a new value on every delivery. If update delivery is enabled, you receive more than one event for the same alert_id (a created event and later updated events), so distinguish them by event_type rather than collapsing them on alert_id.

Prerequisites​

Set up the Tines webhook​

In your Tines story, add an inbound webhook action and configure it to authenticate with a secret:

  1. Add a Webhook action to your story.
  2. Set the action to require a secret, sent as a header (Secret access mode). Note the webhook URL and the secret.

For details, see the Tines webhook action documentation.

The webhook URL must be a webhook action URL, in the form https://<tenant>.tines.com/webhook/<path>.

Store the webhook secret as a Unity Catalog secret​

Lakewatch reads the webhook secret from a Unity Catalog secret, a securable with a three-level name in the form catalog.schema.secret, each time it exports an alert. Lakewatch stores only the secret name, not the secret value.

You can create this secret ahead of time, or create it inline while configuring Tines export with the Create secret button. Either way, creating a secret requires USE CATALOG on the catalog and either ownership of the schema or both CREATE SECRET and USE SCHEMA on the schema. For the steps, see Create a secret.

Required permissions​

To configure Tines export, you need the following:

  • READ SECRET on the Unity Catalog secret that holds the webhook secret, or on its parent schema or catalog. Lakewatch checks that you can read the secret when you save the configuration. To grant it, see Manage permissions on secrets.
  • Permission to edit the alert export configuration in workspace settings.

At export time, Lakewatch reads the webhook secret itself, as its service principal. Because Lakewatch reads the secret by name each time it exports, rotating the secret is zero-touch: update the Unity Catalog secret and Lakewatch uses the new value on the next export, with no change to the export configuration.

Configure Tines export​

Configure a Tines destination for alerts in the Alerts settings section.

  1. In the Lakewatch sidebar, go to Settings, then open Alerts.
  2. Find the Export setting under Alerts.
  3. Set the export destination to Tines.
  4. For Workspace, keep the current workspace unless the destination is behind a specific workspace's network, such as a PrivateLink endpoint or a region-restricted service. This workspace's network delivers the export.
  5. In Webhook URL, enter the Tines webhook action URL (https://<tenant>.tines.com/webhook/<path>).
  6. Set Webhook secret to the Unity Catalog secret that holds the webhook secret. Type or paste its three-level name (catalog.schema.secret), click Select secret to pick an existing secret, or click Create secret to create one from the webhook secret without leaving the page. After you save, the secret field becomes read-only; to update it, rotate the secret in Unity Catalog.
  7. Save your changes.

For the full alert settings reference, see Configure settings.

Troubleshooting​

  • Events don't reach your story: the webhook URL isn't a Tines webhook action URL, or the story is disabled. Confirm the URL is in the https://<tenant>.tines.com/webhook/<path> form and the story is live.
  • The configuration doesn't save: you don't have permission to read the Unity Catalog secret, or the secret name isn't in the catalog.schema.secret form. Confirm your access to the secret and the secret name.
  • Lakewatch reports a successful export but nothing happens in Tines: a 2xx response means Tines accepted the event, not that your story acted on it. Check your Tines story logic.
  • You rotated the webhook secret: update the Unity Catalog secret with the new value. No change to the export configuration is needed.
On this page