Simple and Reliable Automation for Enterprise
What do you like best about the product?
I find Tines super useful in connecting different platforms like Axonious, CrowdStrike, and Wiz. I use Tines to automate manual and repetitive tasks, and it solves the problem of finding discrepancies in cloud account information between Splunk and Wiz. I love everything about Tines because it is simple to use, and even a non-tech person can build stories and get work done. The Copilot feature is particularly valuable as it helps in day-to-day work by solving problems and providing solutions whenever I get stuck. The initial setup was very simple and easy.
What do you dislike about the product?
The form features can be improved and even records capability can be improved as it has some lag.
What problems is the product solving and how is that benefiting you?
I use Tines to automate manual tasks, solve discrepancies in cloud account information, and connect platforms like Axonius and CrowdStrike.
Easy Development, JSON Events, and Outstanding Customer Service
What do you like best about the product?
- Easy of development, and seeing the data on the go.
- To make it simpler, all the events are JSON.
- The customer service is the best part of it.
- AI powered suggestions
- Tonnes of templates, effortless reusability.
What do you dislike about the product?
- Tines forms have not made available a lot of options that are usually common.
- Not very ideal when dealing with the large data volume
What problems is the product solving and how is that benefiting you?
A part of of an automation team, Tines is all I look forward to. The implementations are faster.
Tines Makes Automation Simple and Fast, Even for Non-Tech Users
What do you like best about the product?
I love everything about Tines. It’s simple to use, and even a non-tech person can build stories and get work done. The built-in AI features help with automatically building stories and make it easier to debug. Overall, it saves time when developing any requirement and helps boost productivity.
What do you dislike about the product?
AI help with formulas could be better. Sometimes it gives a formula that uses a method that isn’t supported or doesn’t exist in Tines.
What problems is the product solving and how is that benefiting you?
As I mentioned before, it helps build a quick workflow for requirements and saves time and effort, which in turn boosts the productivity of the engineers using it.
Easy to Use, Seamless Integrations, and Helpful Support
What do you like best about the product?
It’s easy to use for non-tech people, and the UI and integrations with many modern tools are seamless. The support team is also very helpful.
What do you dislike about the product?
Its not too good for large data, it crumbles when dealt with huge data size.
What problems is the product solving and how is that benefiting you?
Tines is helping us automate several security processes. Automating access to security applications, automating alerts and DREs
Effortless Automation with Seamless Integration
What do you like best about the product?
I love how Tines automates daily processes that would be cumbersome to do manually. It's super useful in connecting to different platforms like GCP, Crowdstrike, and Splunk because it makes it really easy to create and store credentials. I appreciate that it's always up-to-date and has AI features that help me when I'm stuck, thanks to the co-pilot/automatic feature. The ease of understanding and using Tines, supported by Tines University, made the transition from XSOAR smooth. It only took me a month to grasp both core and advanced features.
What do you dislike about the product?
I think Tines can help provide an architecture diagram for the flow so it's easy to backtrace or see what we are creating.
What problems is the product solving and how is that benefiting you?
I use Tines to automate daily processes, connect to platforms like GCP and Splunk, and store credentials easily. Its AI features and co-pilot help if stuck, and it keeps me up-to-date.
Easy to Use, Powerful AI Agent Features
What do you like best about the product?
Tines is really easy to use. I also appreciate how quickly they rolled out AI features, and it’s been genuinely useful for our organization. In particular, we’ve gotten a lot of value from the AI Agent features and the AI-powered formula generation.
Tines also has a great support team. We typically hear back within a few hours, and they’re receptive to feature requests, which makes a big difference.
Integrations with tools like Crowdstrike, Jira, Qualys, GCP, AWS, etc., work beautifully and have been smooth to set up and use.
I have never had any issues with performance.
What do you dislike about the product?
None at the moment, but I’d like to share some feedback: Tines’ AI formula generation doesn’t work sometimems. Story Copilot also has a few minor bugs, and I’m hoping it improves in the future.
Also would like to have a RAG feature in Tines AI Agent.
What problems is the product solving and how is that benefiting you?
In our organization, we move data between different systems, and we also use it for reporting and alerting within our security tools.
We also use an AI Agent to analyze reports, which reduces a lot of manual effort.
Automation has transformed alert triage and now powers AI-driven security operations
What is our primary use case?
In the cybersecurity engineering and security automation field, we use Tines to automate the enrichment and analysis of different use cases, including IOC enrichment and bringing AI-powered capabilities into our workflows.
The primary use case is automating our detection use cases. Whenever we create a new detection, the alert is sent to a webhook in Tines, and from that webhook we create a workflow that automates the primary job of the L1 analyst, which is the initial triage of that particular alert. Tines will then create a ticket in our ticketing platform that will be sent directly to the customer, so the initial manual effort after that alert has been created is automated through Tines.
Regarding the scope of impact, we have about 12,000 customers using our product, and for each customer, we generate roughly about five alerts per day. Ninety percent of these alerts are automated through Tines, which is going to reach 100% pretty soon. For each of these alerts, the initial triage costs about 30 minutes to one hour per analyst, and the entire work is being done through Tines, which includes time-consuming enrichment. For example, we have a particular module in Tines that takes in a malicious IP that was seen in a particular alert and drives that IP through different OSINT tools—about seven different OSINT tools—and consolidates the results and generates a risk score for that IP based on all the results. For an analyst, it would take at least one hour to two hours to get the result with this much perfection, but with Tines, it happens instantaneously. Including the enrichment of different IOCs, the workflow does the initial triage of the alert and creates a ticket that has sufficient information that would take a significant amount of time for an analyst to compile manually for each alert. In perspective of 12,000 customers with each customer having about roughly two to five alerts per day, that much alert volume is completely automated through Tines.
Beyond this primary use case, we also use Tines for integrating different tools and making the SOC AI powered. We have a different AI model that we integrate with Tines to bring AI capacity and GenAI capabilities into our day-to-day activities, including detection creation, ticket management, and change control management. We have integrations with GitHub to use this in the DevOps field. However, all of these are smaller use cases compared to the SIEM rules automation, which is the primary one, but we cover a broad spectrum across many different fields.
How has it helped my organization?
Our team, the Security Automation Engineering team, had a primary role to do platform management for Tines. Initially we could only focus on Tines or trying to automate these use cases, but eventually we brought in so much automation that other teams started to pitch in. We only needed to do platform management and we got fewer in numbers because the level of automation got so large that we are now focusing on many different projects and not just level two SOC operations.
What is most valuable?
The API capabilities are what I find most valuable. I have used other SOAR platforms before, and the integration and API capabilities in those other SOAR platforms are relatively difficult to use when compared to Tines. In Tines, if I want to build an integration or API connectivity within different platforms, it is much easier. There are two very helpful actions: one is called Webhook and another is called HTTP Actions. We can use these two, so the webhook will literally accept traffic from the internet and the HTTP action makes it so much easier to send an HTTP request or an API request to different platforms. Using these two actions, we can very easily have interconnectivity, which really adds to the orchestration part when we are using SOAR.
The second feature I find really attractive is called Pages. By using Pages, instead of just creating a workflow, we can also use Pages to add a UI for anyone who is not a builder but who can actually use the workflows. For example, I am creating ten different workflows, and I can connect them through Pages so that someone from my team who is not a builder or a developer can actually use these workflows if I create for them a nice UI using Pages.
What needs improvement?
There are three things that I would say could be better. The first is the Change Control UI. I have noticed that the UI for Change Control is a bit difficult to navigate and assess, but I know that Tines is working on that and so hopefully we will see results soon.
The second thing is the action called Implode. The issue with the Implode action is that once we get a certain number of events into the Implode action, we lose context of all the events except the last one that came in, so it is a bit difficult to send data back once it goes through the Implode action. I have raised this up with Tines, but I do not know if they are working on this or not.
The third thing is the capacity to debug. If my story is not attached to a case, it is a bit difficult to debug if I run into an error. I have to identify the exact event that caused the error and then start debugging from there, so that is not entirely user-friendly. These are the three downfalls that I have noticed with Tines.
For how long have I used the solution?
I have been actively using Tines for about two years.
What do I think about the stability of the solution?
Tines is stable. I cannot speak for the answer to that question before we chose Tines because ever since I joined my organization, Tines has already been there.
What do I think about the scalability of the solution?
Tines has an auto-scaling feature that clearly provides the metrics about the number of workers that have been deployed and the amount of workload that these workers are carrying. We have the capacity to increase and decrease the number of workers to some extent manually, and it has to some extent an auto-scaling feature as well. We can put a ceiling on the permitted auto-scaling so as not to blow up. Whenever this became insufficient, we could easily reach out to the Tines team where they immediately gave us a remedy or fixed the issue. When things felt going off the roof, they have themselves reached out to us saying that these stories are causing issues and we could think of optimizing them or something.
How are customer service and support?
I had direct interactions and the experience was great. The customer support is extremely active and they have an AI-powered customer support that is really, really good. The customer support engineers are extremely friendly. We had an open Slack where we could reach out whenever we wanted clarifications or had requests. We would get a response within six hours in my experience. We would get an AI-powered response immediately, and if that was not sufficient, we could connect to a manual person within six hours and they were really friendly. They were willing to get on call, assess the problem, and provide whatever we needed. We had review meetings every month and we could bring up whatever we thought would be an improvement on our side and they would immediately start prioritizing it and working on that. They also gave us a heads up on whatever new features they were thinking of rolling out.
Whenever we hit roadblocks or issues with the platform or story, even if it was our mistake, the people from the most senior engineering team of Tines immediately were willing to get on call with us to try to solve the issue, and they were also willing to temporarily scale the platform just to accommodate the issue that was going on and then temporarily bring it back down. All of these I have had experience with and it was great.
Which solution did I use previously and why did I switch?
Tines was the first SOAR solution in my organization, but in a different organization, I have worked with different SOAR solutions before.
How was the initial setup?
Tines is a great product. I have used multiple SOAR platforms before and I would say that, I do not know about the cost factor, but otherwise it is a great product and it is amazing to use with its user-friendly features. It is constantly improving, and that is a great thing, so I would highly recommend it.
What was our ROI?
I can speak for fewer employees needed because we used to require many analysts to deal with all the alerts that we were generating, but now we have about 90 to 95% of the alerts already automated through Tines, which requires tremendous time saved and a ton of reduction in the number of analysts required.
What other advice do I have?
We are not in control of the deployment anymore. Initially we were using an S3 bucket to deploy Tines, but now Tines is taking care of the deployment. It used to be Amazon before, but now Tines is in control of that. The overall rating I give this review is 8 out of 10.
Intuitive platform will have you automating in no time at all
What do you like best about the product?
Its hard to say what I like best. Overall I find the platform to be very intuitive and easy to use. Implementation from start to finish requires little prior knowledge of API integrations and the ability to quickly stand up a workflow is a plus. Using out of the box integrations and quickly onboarding your own will take you from 0-100 fast. The platform continues to improve and add value.
What do you dislike about the product?
There are offerings that arent useful to us, like cases, but mostly because we have other tools that perform in that space already.
What problems is the product solving and how is that benefiting you?
We are leveraging Tines across our SOC stack. Its doing the basics from IOC enrichment, handling the repeat tasks like configurations and onboarding, and even performing auditing. We have integrated it across out security components and at this point its touching everything cloud and now even on-prem.
Powerful platform for security teams
What do you like best about the product?
It is highly flexible without any coding. And it is highly scalable across teams.
What do you dislike about the product?
Could be slightly pricey for smaller teams.
What problems is the product solving and how is that benefiting you?
Automatically ingesting alerts from multiple sources, context in alerts like IP reputation, user info, geo data, etc., Slack/email notifications,
Great Experience with Tines in Cybersecurity Operations
What do you like best about the product?
Tines allows us to build powerful automation workflows without writing code, which significantly speeds up our response times. The interface is clean and intuitive, making it easy to connect tools like SIEMs, ticketing systems, and threat intel feeds. I especially appreciate the flexibility and reliability meven complex workflows run smoothly.
What do you dislike about the product?
There’s a slight learning curve when creating advanced workflows, especially for users new to automation. Also, while the no-code approach is great, some integrations require API knowledge, which might be challenging for non-technical users. However, the documentation and support are quite helpful.
What problems is the product solving and how is that benefiting you?
We use Tines primarily for automating security operations workflows, including alert triage, phishing response, threat intelligence enrichment, and incident reporting. It helps streamline repetitive tasks and integrate multiple tools into a single automated process.
