These instructions will help you get started quickly with Tines. The other topics in this help provide detailed information on working with other aspects of the platform.

Accessing Tines

To sign into Tines you need a tenant. A tenant is created when you purchase a Tines plan or when you sign up for a trial.

To create a Tines trial complete this form.

Each Tines tenant has a unique sub domain and can be accessed using a link similar to: https://<tenant-name>


Agents are the building blocks of Tines automation stories. They perform a number of actions, including interaction with 3rd-party tools and services. After performing an action, agents emit events to other agents. They can run on a predefined schedule or when they receive an event. There are seven types of agents in Tines. With just these seven agents, you will be able to automate and scale almost any manual workflow.

Agents are configured using an ‘Options’ block. The ‘Options’ block is a JSON object which defines how the Agent will operate. Each agent type has unique configuration options. The agent types are listed below and are described in detail in the Agents section.

Agent functionality can be expanded through configuration widgets and liquid templating.


Events represent the structured data sent between agents. Tines events are JSON objects, making them flexible and easily to read. A Tines event can be anything from the JSON representation of an anti-virus alert, to an email, or a threat intelligence indicator. The following represents an event emitted by an IMAP agent:

  "message_id": "",
  "folder": "INBOX",
  "subject": "This is a sample email",
  "from": "",
  "to": [""],
  "cc": [],
  "date": "2018-03-12T11:06:48+00:00",
  "mime_type": "text/plain",
  "body": "This is the email body.",
  "matches": {},
  "has_attachment": false

When an agent (Agent A) receives an event it has access to every field contained in the incoming event’s body. Based on the agent’s configuration it will action the event and emit the results in a new event. This event will be emitted to any agent configured to receive events from Agent A.

Every event is timestamped and “write once”, providing an audit trail and making them ideal for calculating key performance metrics for your programs.


Stories are a collection of interconnected agents working towards a singular mission. They can be viewed as analogous to use-cases or playbooks. For example, you might have a Phishing story, an Infected endpoint story or a DDoS story. To support sharing, Stories can be imported and exported.

Tines generates auto-updating visual representations of stories. The below diagram shows a story designed to automate threat detection and response of corporate VPN connections.

Sample Tines story
Sample Tines story

Each Tines tenant includes a number of sample stories to help you get started.