Tines

---
name: tines
description: "Expert agent for Tines security automation. Provides deep expertise in no-code story building, action types (HTTP, Transform, Trigger, Event), team edition (free tier), credential management, story library, and vendor-agnostic security workflow design. WHEN: \"Tines\", \"Tines story\", \"Tines automation\", \"no-code SOAR\", \"Tines action\", \"Tines trigger\", \"Tines transform\", \"Tines free\", \"Tines team edition\"."
license: MIT
---

# Tines

This skill covers Tines, a no-code security automation platform. It has deep knowledge of:

- Story building (workflow design without code)
- Action types: HTTP Request, Transform, Trigger, Event, Send to Story, AI
- Credential management (secure API key and token storage)
- Story Library (pre-built automation templates)
- Team Edition (free tier with full functionality)
- Pages (custom forms for human-in-the-loop workflows)
- Formula language for data transformation
- Webhook-based integrations (vendor-agnostic)
- Multi-team collaboration and story sharing
- Enterprise features (SSO, audit logging, SLA actions)

**Platform note:** Tines differentiates itself with a no-code approach and a generous free tier (Team Edition). It's vendor-agnostic -- it works with any SIEM, EDR, or security tool that has an API.

## How to Approach Tasks

1. **Classify** the request:
   - **Story development** -- Building or optimizing automation workflows
   - **Action configuration** -- HTTP requests, transforms, triggers
   - **Integration** -- Connecting to external APIs (any tool with REST API)
   - **Pages** -- Human-in-the-loop forms and approvals
   - **Architecture** -- Multi-team setup, credential management, story organization

2. **Gather context** -- Tines edition (Team/Business/Enterprise), existing integrations, automation goals

3. **Recommend** actionable guidance with story structure and action configuration examples

## Core Expertise

### Story Architecture

A Tines story is a workflow composed of connected actions:

```
Trigger (webhook receives alert from SIEM)
    |
    v
HTTP Request (enrich IP with VirusTotal API)
    |
    v
Transform (extract and format relevant data)
    |
    v
Trigger (conditional: is IP malicious?)
    |
    ├── Yes:
    │   ├── HTTP Request (block IP on firewall)
    │   ├── HTTP Request (create Jira ticket)
    │   └── HTTP Request (send Slack notification)
    |
    └── No:
        └── Event (log result, no action needed)
```

### Action Types

| Action | Purpose | Key Configuration |
|---|---|---|
| **HTTP Request** | Call any REST API | URL, method, headers, body, authentication |
| **Transform** | Reshape or compute data | Formula expressions, data mapping |
| **Trigger** | Conditional branching | Rules based on incoming data |
| **Event** | Emit data (terminal or intermediate) | Log results, pass data to connected actions |
| **Send to Story** | Call another story (sub-workflow) | Story URL, payload mapping |
| **AI** | LLM-powered analysis | Prompt template, model selection |
| **Page** | Human form/approval | Form fields, approval buttons |
| **SLA** | Time-based escalation | Deadline, escalation actions |

### HTTP Request Action

The HTTP Request action is the integration workhorse:

```json
{
  "action_type": "http_request",
  "name": "Check IP in VirusTotal",
  "options": {
    "url": "https://www.virustotal.com/api/v3/ip_addresses/{{.receive_alert.body.source_ip}}",
    "method": "get",
    "headers": {
      "x-apikey": "{{.CREDENTIAL.virustotal_api_key}}"
    },
    "content_type": "json",
    "retry_on_status": [429, 500, 502, 503]
  }
}
```

**HTTP Request features:**
- Automatic retry with configurable status codes
- Rate limiting (built-in request throttling)
- Response parsing (JSON, XML, HTML, plain text)
- Pagination support (follow next links automatically)
- File upload/download
- mTLS authentication
- Response validation

### Transform Action

Transform actions reshape data using Tines' formula language:

```json
{
  "action_type": "transform",
  "name": "Calculate risk score",
  "options": {
    "mode": "message_only",
    "message": {
      "source_ip": "{{.receive_alert.body.source_ip}}",
      "vt_malicious": "{{.check_ip_in_virustotal.body.data.attributes.last_analysis_stats.malicious}}",
      "risk_score": "{% assign vt_score = .check_ip_in_virustotal.body.data.attributes.last_analysis_stats.malicious | times: 10 %}{% assign abuse_score = .check_ip_in_abuseipdb.body.data.abuseConfidenceScore %}{% assign total = vt_score | plus: abuse_score %}{{total | at_most: 100}}",
      "risk_level": "{% if total > 80 %}critical{% elsif total > 50 %}high{% elsif total > 25 %}medium{% else %}low{% endif %}"
    }
  }
}
```

**Formula language (Liquid-based):**
- `{{.action_name.body.field}}` -- Access action output data
- `{{.CREDENTIAL.name}}` -- Access stored credentials
- `{% if condition %}...{% endif %}` -- Conditional logic
- `{% for item in array %}...{% endfor %}` -- Loop over arrays
- Filters: `| upcase`, `| downcase`, `| size`, `| first`, `| where: "field", "value"`
- Math: `| plus: 5`, `| minus: 2`, `| times: 10`, `| divided_by: 3`
- String: `| split: ","`, `| join: ", "`, `| replace: "old", "new"`, `| truncate: 50`
- Array: `| compact`, `| uniq`, `| sort`, `| reverse`, `| flatten`
- Date: `| date: "%Y-%m-%d"`, `| date_in_time_zone: "US/Eastern"`

### Trigger Action (Conditional)

Triggers evaluate rules to create branches:

```json
{
  "action_type": "trigger",
  "name": "Is IP malicious?",
  "options": {
    "rules": [
      {
        "type": "field>=value",
        "value": "50",
        "path": "{{.calculate_risk_score.risk_score}}"
      }
    ],
    "must_match": 1
  }
}
```

**Rule types:**
- `field==value`, `field!=value` -- Equality
- `field>value`, `field>=value`, `field<value`, `field<=value` -- Comparison
- `field=regex` -- Regular expression match
- `field_is_present` -- Check if field exists
- `field_contains_value` -- Substring check
- Combine with `must_match: all` (AND) or `must_match: 1` (OR)

### Pages (Human-in-the-Loop)

Pages create web forms for human interaction:

```json
{
  "action_type": "page",
  "name": "Analyst approval for containment",
  "options": {
    "page": {
      "title": "Containment Approval Required",
      "description": "IP {{.calculate_risk_score.source_ip}} has risk score {{.calculate_risk_score.risk_score}}",
      "fields": [
        {
          "name": "decision",
          "type": "dropdown",
          "options": ["Approve containment", "Reject - false positive", "Need more info"],
          "required": true
        },
        {
          "name": "notes",
          "type": "textarea",
          "required": false
        }
      ],
      "buttons": [
        {"label": "Submit", "type": "submit"}
      ]
    }
  }
}
```

### Credential Management

Tines securely stores credentials:

- **Types** -- API key, OAuth 2.0, JWT, HTTP basic, custom text
- **Scoping** -- Team-level or story-level
- **Rotation** -- Manual or automated (via stories that update credentials)
- **Access** -- Referenced as `{{.CREDENTIAL.name}}` in actions
- **Audit** -- All credential access is logged

### Story Library

Pre-built stories for common security use cases:

| Category | Example Stories |
|---|---|
| **Phishing** | Email triage, URL analysis, user notification |
| **Threat Intelligence** | IOC enrichment, feed aggregation, blocklist management |
| **Endpoint** | Host investigation, isolation request, malware response |
| **Identity** | Account lockout response, suspicious login triage |
| **Cloud** | AWS GuardDuty response, Azure alert triage |
| **Vulnerability** | CVE notification, scan result triage |
| **Compliance** | Evidence collection, access review automation |

### Team Edition (Free Tier)

Full-featured free tier:

- Unlimited stories
- Unlimited actions per story
- All action types (HTTP, Transform, Trigger, Event, etc.)
- Community credential vault
- Story Library access
- Single-team (no multi-team features)
- Community support

**Limitations vs. paid tiers:**
- No SSO
- No audit logging
- No SLA actions
- No advanced credential management
- Limited to 1 team (no multi-tenant)

## Common Pitfalls

1. **Formula syntax errors** -- Liquid template syntax can be tricky. Test formulas in the action's test panel before activating.
2. **Webhook security** -- Tines webhooks are publicly accessible URLs. Use webhook secrets and validate request signatures.
3. **Rate limiting external APIs** -- Tines can send requests faster than external APIs allow. Use built-in retry with `retry_on_status: [429]` and consider adding delays.
4. **Circular story references** -- Send to Story actions can create infinite loops if Story A calls Story B which calls Story A. Add termination conditions.
5. **Large payload handling** -- Very large API responses (>1MB) may cause performance issues. Use transforms to extract only needed fields early.
6. **Credential exposure in logs** -- Ensure credentials are referenced via `{{.CREDENTIAL.name}}` and never hardcoded in action configurations. Tines masks credentials in logs, but hardcoded values are not masked.