These instructions will help you get started quickly with Tines. The other topics in this help provide detailed information on working with other aspects of the platform.

Accessing Tines

To sign into Tines you need a tenant. A tenant is created when you purchase a Tines plan or when you sign up for community edition.

Each Tines tenant has a unique sub domain and can be accessed using a link similar to: https://<tenant-name>.tines.io.

Actions

Actions are the building blocks of Tines automation stories. They perform a number of functions, including interaction with 3rd-party tools and services. After running, actions emit events to other actions. They can run on a predefined schedule or when they receive an event. There are seven types of actions in Tines. With just these seven actions, you will be able to automate and scale almost any manual workflow.

Actions are configured using an ‘Options’ block. The ‘Options’ block is a JSON object which defines how the Action will operate. Each action type has unique configuration options. The action types are listed below and are described in detail in the Actions section.

Action functionality can be expanded through configuration widgets and liquid templating.

Events

Events represent the structured data sent between actions. Tines events are JSON objects, making them flexible and easily to read. A Tines event can be anything from the JSON representation of an anti-virus alert, to an email, or a threat intelligence indicator. The following represents an event emitted by an IMAP action:

{
  "message_id": "CAEZnBTFKu21fR-5xHtTDsTbmMMNgaVQwEmhd9TCrPWn-UAE0vg@mail.example.com",
  "folder": "INBOX",
  "subject": "This is a sample email",
  "from": "alice@example.com",
  "to": ["tinesdemouser@outlook.com"],
  "cc": [],
  "date": "2018-03-12T11:06:48+00:00",
  "mime_type": "text/plain",
  "body": "This is the email body.",
  "matches": {},
  "has_attachment": false
}

When an action (Action A) receives an event it has access to every field contained in the incoming event’s body. Based on the action’s configuration it will action the event and emit the results in a new event. This event will be emitted to any action configured to receive events from Action A.

Every event is timestamped and “write once”, providing an audit trail and making them ideal for calculating key performance metrics for your programs.

Stories

Stories are a collection of interconnected actions working towards a singular mission. They can be viewed as analogous to use-cases or playbooks. For example, you might have a Phishing story, an Infected endpoint story or a DDoS story. To support sharing, Stories can be imported and exported.

Tines generates auto-updating visual representations of stories. The below diagram shows a story designed to automate threat detection and response of corporate VPN connections.

Sample Tines story
Sample Tines story

Each Tines tenant includes a number of sample stories to help you get started.