Intuitive, Effective Automation with Excellent Support
What do you like best about the product?
I appreciate Tines for its ease of use, especially for non-tech users. The interface is intuitive like a flowchart, which makes it straightforward to automate security processes. The support from Tines is also a standout; they are very prompt and helpful. I find it valuable that Tines integrates easily with different tools, which enhances its usability in our operations.
What do you dislike about the product?
When we deal with huge data Tines isn't useful. Tines has limitations with data size and counts, so if that can be improved would be helpful.
What problems is the product solving and how is that benefiting you?
I use Tines for SOAR automation. It's easy for non-tech users with a flowchart-like UI, automating security processes and integrating with tools like ServiceNow. The prompt support and many integration features make it valuable.
Tines Keeps Workflows Calm, Organised, and Simple
What do you like best about the product?
Tines feels like that one colleague who somehow stays perfectly organised and calm, even when everything around you gets chaotic. It’s genuinely refreshing to use a tool that simplifies your day instead of piling on yet another layer of complexity at work.
What do you dislike about the product?
I’m expecting some latency issues and general slowness when handling a large volume of data and requests.
What problems is the product solving and how is that benefiting you?
It helps us do more automation and complete tasks efficiently. It has been useful for achieving our goals and supporting our company use cases.
Simple and Reliable Automation for Enterprise
What do you like best about the product?
I find Tines super useful in connecting different platforms like Axonious, CrowdStrike, and Wiz. I use Tines to automate manual and repetitive tasks, and it solves the problem of finding discrepancies in cloud account information between Splunk and Wiz. I love everything about Tines because it is simple to use, and even a non-tech person can build stories and get work done. The Copilot feature is particularly valuable as it helps in day-to-day work by solving problems and providing solutions whenever I get stuck. The initial setup was very simple and easy.
What do you dislike about the product?
The form features can be improved and even records capability can be improved as it has some lag.
What problems is the product solving and how is that benefiting you?
I use Tines to automate manual tasks, solve discrepancies in cloud account information, and connect platforms like Axonius and CrowdStrike.
Easy Development, JSON Events, and Outstanding Customer Service
What do you like best about the product?
- Easy of development, and seeing the data on the go.
- To make it simpler, all the events are JSON.
- The customer service is the best part of it.
- AI powered suggestions
- Tonnes of templates, effortless reusability.
What do you dislike about the product?
- Tines forms have not made available a lot of options that are usually common.
- Not very ideal when dealing with the large data volume
What problems is the product solving and how is that benefiting you?
A part of of an automation team, Tines is all I look forward to. The implementations are faster.
Easy to Use, Seamless Integrations, and Helpful Support
What do you like best about the product?
It’s easy to use for non-tech people, and the UI and integrations with many modern tools are seamless. The support team is also very helpful.
What do you dislike about the product?
Its not too good for large data, it crumbles when dealt with huge data size.
What problems is the product solving and how is that benefiting you?
Tines is helping us automate several security processes. Automating access to security applications, automating alerts and DREs
Effortless Automation with Seamless Integration
What do you like best about the product?
I love how Tines automates daily processes that would be cumbersome to do manually. It's super useful in connecting to different platforms like GCP, Crowdstrike, and Splunk because it makes it really easy to create and store credentials. I appreciate that it's always up-to-date and has AI features that help me when I'm stuck, thanks to the co-pilot/automatic feature. The ease of understanding and using Tines, supported by Tines University, made the transition from XSOAR smooth. It only took me a month to grasp both core and advanced features.
What do you dislike about the product?
I think Tines can help provide an architecture diagram for the flow so it's easy to backtrace or see what we are creating.
What problems is the product solving and how is that benefiting you?
I use Tines to automate daily processes, connect to platforms like GCP and Splunk, and store credentials easily. Its AI features and co-pilot help if stuck, and it keeps me up-to-date.
Easy to Use, Powerful AI Agent Features
What do you like best about the product?
Tines is really easy to use. I also appreciate how quickly they rolled out AI features, and it’s been genuinely useful for our organization. In particular, we’ve gotten a lot of value from the AI Agent features and the AI-powered formula generation.
Tines also has a great support team. We typically hear back within a few hours, and they’re receptive to feature requests, which makes a big difference.
Integrations with tools like Crowdstrike, Jira, Qualys, GCP, AWS, etc., work beautifully and have been smooth to set up and use.
I have never had any issues with performance.
What do you dislike about the product?
None at the moment, but I’d like to share some feedback: Tines’ AI formula generation doesn’t work sometimems. Story Copilot also has a few minor bugs, and I’m hoping it improves in the future.
Also would like to have a RAG feature in Tines AI Agent.
What problems is the product solving and how is that benefiting you?
In our organization, we move data between different systems, and we also use it for reporting and alerting within our security tools.
We also use an AI Agent to analyze reports, which reduces a lot of manual effort.
Automation has transformed alert triage and now powers AI-driven security operations
What is our primary use case?
In the cybersecurity engineering and security automation field, we use Tines to automate the enrichment and analysis of different use cases, including IOC enrichment and bringing AI-powered capabilities into our workflows.
The primary use case is automating our detection use cases. Whenever we create a new detection, the alert is sent to a webhook in Tines, and from that webhook we create a workflow that automates the primary job of the L1 analyst, which is the initial triage of that particular alert. Tines will then create a ticket in our ticketing platform that will be sent directly to the customer, so the initial manual effort after that alert has been created is automated through Tines.
Regarding the scope of impact, we have about 12,000 customers using our product, and for each customer, we generate roughly about five alerts per day. Ninety percent of these alerts are automated through Tines, which is going to reach 100% pretty soon. For each of these alerts, the initial triage costs about 30 minutes to one hour per analyst, and the entire work is being done through Tines, which includes time-consuming enrichment. For example, we have a particular module in Tines that takes in a malicious IP that was seen in a particular alert and drives that IP through different OSINT tools—about seven different OSINT tools—and consolidates the results and generates a risk score for that IP based on all the results. For an analyst, it would take at least one hour to two hours to get the result with this much perfection, but with Tines, it happens instantaneously. Including the enrichment of different IOCs, the workflow does the initial triage of the alert and creates a ticket that has sufficient information that would take a significant amount of time for an analyst to compile manually for each alert. In perspective of 12,000 customers with each customer having about roughly two to five alerts per day, that much alert volume is completely automated through Tines.
Beyond this primary use case, we also use Tines for integrating different tools and making the SOC AI powered. We have a different AI model that we integrate with Tines to bring AI capacity and GenAI capabilities into our day-to-day activities, including detection creation, ticket management, and change control management. We have integrations with GitHub to use this in the DevOps field. However, all of these are smaller use cases compared to the SIEM rules automation, which is the primary one, but we cover a broad spectrum across many different fields.
How has it helped my organization?
Our team, the Security Automation Engineering team, had a primary role to do platform management for Tines. Initially we could only focus on Tines or trying to automate these use cases, but eventually we brought in so much automation that other teams started to pitch in. We only needed to do platform management and we got fewer in numbers because the level of automation got so large that we are now focusing on many different projects and not just level two SOC operations.
What is most valuable?
The API capabilities are what I find most valuable. I have used other SOAR platforms before, and the integration and API capabilities in those other SOAR platforms are relatively difficult to use when compared to Tines. In Tines, if I want to build an integration or API connectivity within different platforms, it is much easier. There are two very helpful actions: one is called Webhook and another is called HTTP Actions. We can use these two, so the webhook will literally accept traffic from the internet and the HTTP action makes it so much easier to send an HTTP request or an API request to different platforms. Using these two actions, we can very easily have interconnectivity, which really adds to the orchestration part when we are using SOAR.
The second feature I find really attractive is called Pages. By using Pages, instead of just creating a workflow, we can also use Pages to add a UI for anyone who is not a builder but who can actually use the workflows. For example, I am creating ten different workflows, and I can connect them through Pages so that someone from my team who is not a builder or a developer can actually use these workflows if I create for them a nice UI using Pages.
What needs improvement?
There are three things that I would say could be better. The first is the Change Control UI. I have noticed that the UI for Change Control is a bit difficult to navigate and assess, but I know that Tines is working on that and so hopefully we will see results soon.
The second thing is the action called Implode. The issue with the Implode action is that once we get a certain number of events into the Implode action, we lose context of all the events except the last one that came in, so it is a bit difficult to send data back once it goes through the Implode action. I have raised this up with Tines, but I do not know if they are working on this or not.
The third thing is the capacity to debug. If my story is not attached to a case, it is a bit difficult to debug if I run into an error. I have to identify the exact event that caused the error and then start debugging from there, so that is not entirely user-friendly. These are the three downfalls that I have noticed with Tines.
For how long have I used the solution?
I have been actively using Tines for about two years.
What do I think about the stability of the solution?
Tines is stable. I cannot speak for the answer to that question before we chose Tines because ever since I joined my organization, Tines has already been there.
What do I think about the scalability of the solution?
Tines has an auto-scaling feature that clearly provides the metrics about the number of workers that have been deployed and the amount of workload that these workers are carrying. We have the capacity to increase and decrease the number of workers to some extent manually, and it has to some extent an auto-scaling feature as well. We can put a ceiling on the permitted auto-scaling so as not to blow up. Whenever this became insufficient, we could easily reach out to the Tines team where they immediately gave us a remedy or fixed the issue. When things felt going off the roof, they have themselves reached out to us saying that these stories are causing issues and we could think of optimizing them or something.
How are customer service and support?
I had direct interactions and the experience was great. The customer support is extremely active and they have an AI-powered customer support that is really, really good. The customer support engineers are extremely friendly. We had an open Slack where we could reach out whenever we wanted clarifications or had requests. We would get a response within six hours in my experience. We would get an AI-powered response immediately, and if that was not sufficient, we could connect to a manual person within six hours and they were really friendly. They were willing to get on call, assess the problem, and provide whatever we needed. We had review meetings every month and we could bring up whatever we thought would be an improvement on our side and they would immediately start prioritizing it and working on that. They also gave us a heads up on whatever new features they were thinking of rolling out.
Whenever we hit roadblocks or issues with the platform or story, even if it was our mistake, the people from the most senior engineering team of Tines immediately were willing to get on call with us to try to solve the issue, and they were also willing to temporarily scale the platform just to accommodate the issue that was going on and then temporarily bring it back down. All of these I have had experience with and it was great.
Which solution did I use previously and why did I switch?
Tines was the first SOAR solution in my organization, but in a different organization, I have worked with different SOAR solutions before.
How was the initial setup?
Tines is a great product. I have used multiple SOAR platforms before and I would say that, I do not know about the cost factor, but otherwise it is a great product and it is amazing to use with its user-friendly features. It is constantly improving, and that is a great thing, so I would highly recommend it.
What was our ROI?
I can speak for fewer employees needed because we used to require many analysts to deal with all the alerts that we were generating, but now we have about 90 to 95% of the alerts already automated through Tines, which requires tremendous time saved and a ton of reduction in the number of analysts required.
What other advice do I have?
We are not in control of the deployment anymore. Initially we were using an S3 bucket to deploy Tines, but now Tines is taking care of the deployment. It used to be Amazon before, but now Tines is in control of that. The overall rating I give this review is 8 out of 10.
Powerful platform for security teams
What do you like best about the product?
It is highly flexible without any coding. And it is highly scalable across teams.
What do you dislike about the product?
Could be slightly pricey for smaller teams.
What problems is the product solving and how is that benefiting you?
Automatically ingesting alerts from multiple sources, context in alerts like IP reputation, user info, geo data, etc., Slack/email notifications,
Invaluable for our organization
What do you like best about the product?
Tines has been an invaluable asset to our team, and their support truly sets them apart. We consistently receive exceptional help from their support team, who always make time to address our questions and challenges. Beyond just troubleshooting, they're proactive in coming up with innovative ideas for new automation workflows that significantly boost our efficiency. It's truly a reliable platform that we've come to depend on for critical operations.
What do you dislike about the product?
While there's certainly a learning curve to mastering the system, Tines' incredibly helpful support team makes that process much smoother and more manageable.
What problems is the product solving and how is that benefiting you?
Tines is solving several critical problems for our IT team, directly translating into significant benefits:
Automating User Lifecycle Management (Onboarding & Offboarding):
Problem Solved: Previously, manual onboarding and offboarding were time-consuming, prone to human error, and posed security risks due to potential delays in access provisioning or revocation.
Benefit: Tines now automates the creation and deprovisioning of user accounts, syncing seamlessly with Okta. This ensures new hires gain access swiftly and departing employees have their access revoked securely and consistently. This has vastly improved our efficiency, enhanced our security posture, and strengthened our compliance.
Streamlining Offboarding Workflows via Slack:
Problem Solved: Initiating offboarding required specific access and potentially switching between different systems, adding friction to the process.
Benefit: The custom Slack automation we've built empowers us to initiate offboarding workflows directly from Slack. This streamlines our daily operations, making the process more convenient and responsive for the team.
