April 2021 Summaries
73 posts from Tines
Filter
Month:
Year:
Post Summaries
Back to Blog
Detecting and responding to CEO fraud poses significant challenges for security teams as traditional security measures often fail against this type of attack, which typically involves impersonating senior executives to trick employees into transferring funds or providing sensitive information. The Tines Security Orchestration Automation and Response (SOAR) platform, when used with G Suite and Microsoft Exchange features, enhances the detection and response to such fraud by automating the flagging of suspicious emails through keyword analysis and regular expressions. By leveraging Tines' automation capabilities, security teams can quickly inform targeted employees via Slack or email about potential fraud, allowing them to respond appropriately. Additionally, Tines facilitates further actions such as creating incident tickets, blacklisting senders, and sharing information with peers, thereby streamlining the response process and adapting to evolving security needs.
Apr 27, 2021
880 words in the original blog post.
Managing risk in digital environments involves establishing effective Vulnerability Management (VM) processes, with an emphasis on education and early integration of security measures into project lifecycles to avoid last-minute surprises or conflicts. The text discusses leveraging Qualys for automating vulnerability management tasks, emphasizing the use of its APIs for efficient risk identification and management. It provides a step-by-step guide for using cURL to perform essential API actions, such as adding IP addresses as assets, running scans, and generating reports, as well as addressing common API usage concerns like documentation, endpoints, authentication, and limitations. Additionally, the text highlights the use of Tines to create a visual workflow that enhances the self-service capability for security tasks, enabling seamless integration with project management tools like Jira for case management, thereby empowering teams to proactively manage security issues.
Apr 27, 2021
1,767 words in the original blog post.
Managing abuse inboxes and phishing responses in an enterprise can be complex, but the Tines Advanced Security Automation Platform offers a solution by automating these processes. A multi-part video series provides a detailed guide on how to utilize this platform for efficient and effective phishing response management. Part 1 of the series specifically addresses reading emails from an IMAP server, extracting URLs from email bodies, checking URL statuses with VirusTotal, determining potential threats, and informing victims of the analysis results. The series also offers resources like the Tines Community Edition and VirusTotal API and mentions a recent terminology update where "agents" are now called "Actions."
Apr 27, 2021
142 words in the original blog post.
Organizations are increasingly adopting cloud-based Security Information and Event Management (SIEM) solutions like Azure Sentinel due to advantages such as affordable cloud storage and abstracted compute resources. Azure Sentinel, introduced by Microsoft in 2019, has become a powerful tool for both small businesses and large organizations by integrating valuable data, such as Microsoft 365. Tines, a no-code automation platform, enhances the capabilities of Azure Sentinel by automating interactions with alerts, querying data via the Log Analytics backend, and leveraging threat intelligence indicators. The use of Microsoft Graph API and Azure Log Analytics allows for efficient management and analysis of security data, enabling agile responses to potential threats. By utilizing Tines, security teams can create workflows that integrate with various tools, such as ticketing systems and threat intelligence platforms.
Apr 27, 2021
1,156 words in the original blog post.
In this continuation of a series on automating the management of abuse inboxes and phishing responses, the focus is on enhancing automation processes using Tines. The text details how to automate responses to user interactions with malicious emails, including logging out and locking user accounts via OneLogin to prevent account takeovers. It also outlines the use of Splunk for conducting SIEM searches to track potential victims of phishing attacks by analyzing web proxy and DHCP logs. Furthermore, the guide explains how to integrate asset management with Jira to identify and secure compromised user accounts. Through these processes, the series demonstrates the evolution of an automation Story from basic email analysis to a complex system with over 50 automated Actions, highlighting the scalability and extendability of Tines for more advanced threat response and management.
Apr 27, 2021
2,343 words in the original blog post.
The text outlines the approach Tines takes to enhance the experience of its security automation platform demos by automating the scheduling and customization processes. Typically, vendor demos are seen as inefficient, with excessive time spent on introductions and generic content rather than the product itself. To counter this, Tines employs its SOAR platform to automate demo preparation, using tools like Calendly for scheduling and collecting customer details, while allowing customers to select the demo content that interests them most. This customization is further refined by passively gathering open-source intelligence about the customer to tailor the demo more precisely. Ultimately, the aim is to streamline the demo experience, making it more effective and engaging, while highlighting the flexibility and integration capabilities of the Tines platform, even though the success of such demos still largely depends on the presenter's skills.
Apr 27, 2021
804 words in the original blog post.
The text discusses the advantages and strategies of using the Tines Security Orchestration Automation and Response (SOAR) platform, which is designed to simplify security tasks even for those without coding experience. It emphasizes the importance of automating repetitive and time-consuming tasks often faced by security analysts, such as processing abuse reports and triaging low-level incidents. The platform offers features like alert deduplication, context enrichment, and correlation of alerts to streamline security operations and reduce alert fatigue. Additionally, Tines promotes the use of "Prompts" for swift incident response actions and encourages crowdsourcing for managing noisy alerts, enabling security teams to focus on more impactful work. By automating these processes, Tines helps security teams improve efficiency and accuracy in handling security incidents.
Apr 27, 2021
1,556 words in the original blog post.
The document provides a comprehensive guide on enhancing cloud security using Tines in conjunction with AWS services, specifically focusing on setting up automated responses to security events. It outlines the integration of Tines with AWS Simple Notification Service (SNS) to receive events and AWS GuardDuty for detecting security threats, while emphasizing the importance of deploying services within the same AWS region. The guide details the setup process for creating webhook actions in Tines to receive SNS alerts, and using AWS CloudWatch to route GuardDuty alerts through SNS to Tines. It further explains how to automate responses to specific security threats, such as public access to S3 buckets, by setting up IAM credentials and configuring Tines to automatically apply security policies and create Jira tickets for incident tracking. The document highlights the flexibility and potential of using Tines and AWS tools to proactively manage cloud security risks.
Apr 27, 2021
1,277 words in the original blog post.
Brandon Maxwell, Detection & Response Manager at Auth0, outlines how the team leverages Tines to automate and enhance their Alert Development Lifecycle, with a focus on documentation and standardization using Palantir’s Alerting and Detection Strategies Framework. By automating as many tasks as possible, including phishing analysis and other alert processes, the team ensures effective and informed responses to security alerts. Alerts are enriched through the Tines platform, enabling better decision-making by correlating data from various sources. The process involves filtering out false positives, dynamically adjusting the severity of alerts, and deploying automated responses, such as quarantining phishing emails. Auth0's SecurityBot, developed using Tines, facilitates interaction with team members, prompting user verification and further automating responses based on user feedback. This approach, inspired by similar initiatives from companies like Dropbox and Slack, demonstrates a commitment to optimizing security operations through automation, while acknowledging the limitations of full automation in certain scenarios.
Apr 27, 2021
960 words in the original blog post.
Splunk Enterprise is a comprehensive data platform that facilitates data ingestion, manipulation, and analytics, and can be automated using APIs for efficient threat-hunting and self-service internal tooling. The platform supports a variety of data sources and features its own Search Processing Language (SPL) and robust API capabilities, best accessed through an AWS AMI instance for exploring its functionalities. The setup includes a forwarder on a Windows host and a receiver on Splunk Enterprise, with authentication options like Basic HTTP and token authentication. The guide explores using cURL and Tines for automating search operations, with Tines offering a more modular and resilient workflow, including polling, error checking, and email notifications for results. This enhances usability by allowing automation of threat-hunting processes, and with a constructed front-end form, different teams can leverage these automated workflows without requiring software development expertise, thereby streamlining internal operations and enabling rapid deployment of internal tools.
Apr 27, 2021
2,782 words in the original blog post.
The text discusses the implementation of the ELK (Elasticsearch, Logstash, Kibana) stack, enhanced by the addition of Beats, to automate threat-hunting tools using Elasticsearch's Search API. This involves configuring an Ubuntu server with security measures like enabling authentication and creating API keys. The document outlines the process for setting up and using the Elasticsearch Search API, including its limitations, authentication methods, and how to generate API keys for secure interactions. Additionally, it highlights the use of Tines, a no-code automation platform, to create workflows for threat detection, such as querying DNS packet attributes and IP traffic. The text provides a practical example of using Tines to streamline API interactions, query DNS information, and efficiently manage the workflow through automated processes, ultimately enhancing security operations by reducing manual intervention and facilitating easy sharing of workflows.
Apr 27, 2021
2,268 words in the original blog post.
The CrowdStrike Falcon platform offers robust endpoint protection through various features like EDR, next-generation antivirus, and device control, alongside operational capabilities in IT and security, such as threat intelligence. To leverage its API, users must navigate documentation, determine endpoint access, and authenticate, primarily using the OAuth2.0 model since key-based authentication is deprecated. Users must also consider API limitations, including rate limits. For testing, tools like cURL and Postman can be used, though Tines is recommended for its native OAuth2.0 support. Setting up involves creating API client keys, configuring credentials in Tines, and defining resources for streamlined API interactions, which facilitate constructing workflows and executing actions in Tines, showcasing CrowdStrike's detection capabilities.
Apr 27, 2021
1,113 words in the original blog post.
Tines has introduced a new feature called "Teams," which allows users to invite others to the platform while maintaining privacy for sensitive Stories and resources. This feature, which has been highly requested by customers, enables the creation of distinct teams within the Tines platform, where members can manage Stories, credentials, and resources independently from other teams. The update includes a redesigned user interface and improved functionalities, such as enhanced HTTP Request credential capabilities and AWS Credentials role assumption. Teams addresses the need for privacy by allowing users to keep critical Stories and data restricted to specific team members, and it includes a "Drafts" section for personal, private Stories. While legacy private credentials will continue to function, users are encouraged to transition them to the appropriate team as part of the new structure. Overall, this feature aims to facilitate collaboration while ensuring data security and privacy.
Apr 27, 2021
871 words in the original blog post.
Businesses increasingly rely on G Suite, making the ability to detect and respond to suspicious activities crucial for security teams, who can leverage Google's comprehensive reporting and logging tools. However, transferring these logs to a centralized logging environment such as a SIEM can be complex, often requiring a software engineering project. The use of Tines offers a solution by automating the process of extracting logs from G Suite and forwarding them to an ELK stack (Elasticsearch, Logstash, Kibana) for analysis and alerting. This process involves enabling the G Suite Admin SDK API, creating a service account, and setting up Tines credentials to authenticate G Suite access. It automates log fetching and conversion into individual events before sending them to Logstash and ELK, allowing security teams to index, search, and set alerts for suspicious behaviors without needing to write code. The integration of Tines streamlines security operations by providing a reliable and scalable method to handle G Suite data efficiently.
Apr 27, 2021
1,125 words in the original blog post.
Modern detection and response teams face the challenge of processing vast amounts of log data from various sources in the cloud, requiring efficient workflows for analyzing logs, generating alerts, and determining their validity. The integration of Panther and Tines offers a solution by automating these processes, allowing security teams to focus on critical issues. In a given scenario, Okta SSO logs are analyzed with Panther to alert on any user granted Administrator privileges, which is crucial as SSO controls access to internal systems. Alerts are sent to Tines via a webhook to automate responses such as checking for malicious IPs and confirming user actions through Slack. Depending on user responses, further actions like creating a new case or locking an account may be taken. Panther's ability to collect, normalize, and query logs using SQL, combined with Tines' drag-and-drop workflow builder, allows for the automation of threat intelligence lookups and incident escalation. This approach not only enhances security but also reduces manual workload and burnout in security operations centers (SOCs), demonstrating a scalable method to maintain strong security in growing cloud environments.
Apr 27, 2021
1,416 words in the original blog post.
Tines has launched the Tines Community Edition, a fully-featured and free cloud instance of their automation platform, aimed at helping teams automate repetitive tasks to enhance efficiency and engagement. This edition offers all the enterprise-grade features of their paid plans, such as Action templates, reporting, Story runs, forms, Action monitoring, and SSO/SAML, without requiring any upfront commitment. The initiative reflects Tines' commitment to making powerful automation tools accessible to teams of all sizes, allowing them to save time and work more effectively.
Apr 27, 2021
160 words in the original blog post.
Tines has successfully completed a $26 million Series-B funding round led by Addition, with participation from previous investors Blossom Capital and Accel, and new strategic investors CrowdStrike and Silicon Valley CISO Investments. Founded to create a product that enhances security team efficiency, Tines aims to use this capital to support its rapid growth and further develop its automation platform, which allows users to automate complex processes without needing extensive technical expertise. As enterprises face increasing tool proliferation and data sprawl, Tines addresses these challenges by enabling frontline teams to implement effective, scalable automation solutions. The company emphasizes its commitment to democratizing automation, driven by the demands of innovative companies and supported by the launch of the Tines Community Edition. Tines is actively expanding its team and invites applications from candidates who resonate with its mission, even if they don't meet every requirement or need flexible working conditions. This milestone is credited to the dedicated Tines team, supportive investors, and customers who continuously inspire product development.
Apr 27, 2021
604 words in the original blog post.
Automating Google Workspace security tasks using Tines involves leveraging OAuth 2.0 with a service account to streamline the management of domain resources such as users and groups. By enabling the Admin SDK, creating a service account, and configuring domain-wide delegation in the Google Workspace admin console, security teams can efficiently manage access and automate workflows. Tines uses JSON Web Tokens (JWT) to authenticate and authorize actions, allowing for secure interactions with Google APIs. This setup facilitates tasks like fetching access tokens and retrieving user data, ultimately enhancing the automation capabilities of a company's security program through seamless integration with Google Workspace.
Apr 27, 2021
1,143 words in the original blog post.
Information security analysts and engineers can benefit significantly from deploying a Security Orchestration, Automation, and Response (SOAR) solution, which reduces repetitive tasks, false positives, and alerts requiring investigation. Convincing management to evaluate such tools can be challenging, so a strategic proposal is necessary. Tines suggests focusing on a single, acute problem and crafting a compelling pitch using a provided deck template to guide the process. The proposal should begin with a clear problem statement, followed by structuring and testing a hypothesis, conducting thorough analysis, and synthesizing insights to encourage management buy-in. This approach ensures the proposal is data-driven, focuses on the return on investment of a SOAR platform, and is free from confirmation bias, ultimately demonstrating the potential value of implementing a security automation solution.
Apr 27, 2021
982 words in the original blog post.
The integration of TheHive, a scalable open-source security incident response platform, with Tines, a no-code automation platform, is explored to automate the creation of alerts from phishing emails and other security incidents. This combination allows companies to streamline their incident response processes by enhancing the tracking of response times, resolutions, and detection methods, thus improving overall security program efficacy. By leveraging TheHive's case management capabilities alongside Tines' automation across multiple tools, organizations can create alerts from various sources such as emails, SIEM alerts, and EDR tools, while also enriching these alerts using data from platforms like Cortex. The process involves setting up TheHive and Tines, obtaining API keys, and configuring actions in Tines to automatically generate alerts in TheHive, thereby reducing manual effort and increasing productivity. Additionally, the integration facilitates the automated handling of emails, enabling the creation of security cases for every email received, with the potential for further development to analyze attachments and URLs within these emails.
Apr 27, 2021
1,140 words in the original blog post.
Google Workspace, formerly G Suite, offers APIs that allow users to extend the functionality of its productivity and collaboration tools by building custom workflows and security responses for specific events through webhooks. This process involves subscribing to Google Workspace endpoints to receive push notifications for user account events, thereby facilitating the creation of tailored security responses. Authentication is achieved using OAuth 2.0 with server-to-server communication, utilizing service accounts and JWT tokens to avoid the need for interactive authorization. The setup requires creating and managing API credentials, and it is crucial to verify domains and renew push notification subscriptions due to expiration limits. Tools like Tines facilitate testing and building workflows, enabling users to automate responses to events such as password changes or multi-factor authentication updates. Workflows can trigger further actions, such as sending emails or initiating incident responses, demonstrating the flexibility and extensibility of using Google Workspace APIs to enhance organizational processes.
Apr 27, 2021
1,411 words in the original blog post.
Tines focuses on creating accessible primitives for integrating products and services, such as data reception, text modification, condition checking, and HTTP requests, enabling users to build Stories with these capabilities. The platform balances broad and specific tool development, illustrated by the discussion on the Levenshtein distance for phishing detection. Instead of directly integrating it, the flexibility of AWS Lambda is highlighted, which allows for the execution of short computational tasks like calculating data similarity using Python's FuzzyWuzzy library. The text provides a walkthrough of creating and deploying a Lambda function for this purpose and integrating it into Tines using the "Invoke AWS Lambda Function" template. This approach allows users to perform complex operations efficiently, demonstrating the synergy between Tines and AWS Lambda in solving specific computational challenges.
Apr 27, 2021
1,032 words in the original blog post.
Credential management is crucial when working with APIs, as it ensures both security and accessibility. Tines offers various credential storage options, including basic text, OAuth, and AWS credentials, with the HTTP Request action credential (HRAC) being one of the most versatile. HRAC allows dynamic API authentication, such as refreshing credentials for platforms like TruStar, which use time-limited tokens, reducing the need for frequent credential rotation. By leveraging HRAC, users can securely interact with password vaults and privileged access managers, exemplified by accessing secrets from HashiCorp Vault. Although HRAC does not currently support variable passing or array iteration, it remains a powerful tool for managing API interactions within the Tines environment, usable across the Tines Storyboard for actions like indicator searches with TruStar.
Apr 27, 2021
493 words in the original blog post.
Auth0's Senior Incident Response Engineer, Adam Maksimuk, describes the implementation of an Incident Response (IR) Bot using the Tines platform to streamline and document the incident management process. The bot automates routine tasks such as setting up incident channels in Slack, creating Confluence pages, and managing case information in Hive. It assigns roles like Incident Commander and Scribe, who are responsible for task delegation, documentation, and incident management. The bot facilitates user invitations, task assignments via Jira, and provides reminders to ensure tasks are completed. It also aids in maintaining incident timelines by allowing scribes to easily document key events in Confluence. The bot sends periodic updates to the channel, helping keep participants informed of the incident's status. Upon incident resolution, the bot archives the channel and updates the status in Confluence and Hive. Additionally, it tracks user activity and sends metrics to SumoLogic, providing insights into user engagement during incidents. This automation reduces the manual workload for the response team and enhances the efficiency and accuracy of incident management.
Apr 27, 2021
2,553 words in the original blog post.
Tines leverages automation to efficiently manage its DevSecOps program, particularly in the deployment and monitoring of customer trial environments. The platform automates various tasks, such as creating and managing infrastructure on Digital Ocean, tracking contacts and trials through Hubspot, and sending notifications via SendGrid. When a trial is requested, Tines uses a system of pre-configured "trial-pending" droplets that are quickly set up for users, with automated updates and DNS configurations handled through the Digital Ocean API. If no droplets are available, an event transformation action pauses the process while a new droplet is prepared. Post-deployment, trial details are integrated with Hubspot to manage customer lifecycle, and SendGrid handles transactional emails, ensuring seamless communication and support notifications. This automation framework is central to Tines’ internal operations and customer management processes.
Apr 27, 2021
559 words in the original blog post.
The blog explores the creation and implementation of a Slack Chatbot for security and IT teams, highlighting the concept of "chatops," which integrates people, tools, processes, and automation into a unified workflow. By creating a Slack Chatbot, teams can improve communication and collaboration through automated actions and alerts. The article details setting up an OAuth application in Slack, configuring features such as Incoming Webhooks, Interactive Components, Slash Commands, and Bots, and utilizing these features to send notifications and automate interactions. It explains how to create and configure different Slack actions using Tines, including posting messages, executing slash commands, and integrating with third-party services like VirusTotal for domain analysis. Additionally, the blog discusses how to send proactive notifications to individual Slack users and emphasizes the use of rich notifications and blocks for creating user-friendly messages. The article also covers how to search for users within Slack and demonstrates how to send direct messages to users, enhancing the chatbot's functionality to support various automation stories.
Apr 26, 2021
2,013 words in the original blog post.
In 2019, as sourcing and retaining talent became challenging for Security and IT organizations, many companies turned to remote work and distributed teams, utilizing communication tools like Slack and Microsoft Teams to enhance collaboration. This has led to the adoption of "ChatOps," a model that integrates people, tools, processes, and automation into workflows, often aided by chatbots that allow users to perform actions within chat applications. The blog explores the creation and implementation of chatbots using the Tines Automation platform to facilitate ChatOps, particularly focusing on setting up chatbots in Microsoft Teams and Slack, which can receive commands and send proactive notifications. It provides detailed instructions on creating a Microsoft Teams chatbot that can analyze domains using services like VirusTotal and URLHaus, emphasizing the benefits of maintaining focus and performing impactful work within a single interface. The tutorial outlines the steps to develop a bot that processes commands, sends data, and replies with analysis results, while also highlighting potential automation use cases such as enriching domains, escalating tickets, and conducting vulnerability scans. The series aims to guide users through setting up communication and notification bots, with future parts focusing on proactive notifications in Microsoft Teams.
Apr 26, 2021
1,585 words in the original blog post.
In a three-part series on security automation for handling account compromises, the first part focuses on detection using the HaveIBeenPwned (HIBP) Domain Search service to automate responses to stolen credential threats. By setting up automated workflows triggered through HIBP alerts, organizations can reduce response times, minimize exposure windows, and enhance their defensive capabilities. The process involves checking a designated security mailbox for breach notifications every three minutes and using a webhook for additional triggers. This modular automation allows for easy integration of new checks over time and facilitates rapid adaptation to evolving risks. The initial detection phase leads to querying the HIBP API to identify specific email accounts involved in breaches, followed by enrichment and case creation in subsequent phases.
Apr 26, 2021
840 words in the original blog post.
In the Autumn 2019 update, Tines introduced the Storyboard feature, a significant enhancement to their security automation platform. Replacing the previously static diagrams, the Storyboard offers a more interactive and efficient way to create automation stories, reportedly improving speed by up to five times. This new feature allows users to drag and drop Action types from the left panel, easily define sources and receivers by connecting them directly on the Storyboard, and utilize templates from a searchable library. The right panel displays Action properties, making it simpler to configure and edit options without leaving the main view. This update marks a substantial improvement over the older system, addressing previous limitations such as lack of interactivity, cumbersome navigation, and difficulty in differentiating Action types.
Apr 26, 2021
356 words in the original blog post.
In the digital security landscape, Thinkst Canary tools and Tines offer a robust solution for breach detection and incident response by leveraging honeypots and honeytokens to deceive attackers and gather valuable intelligence. This approach enhances detection capabilities, allowing defenders to automate their response processes while maintaining human oversight through interactive prompts. By strategically deploying canaries in sensitive areas and using Tines for automation, organizations can quickly identify and respond to unauthorized access, minimizing attackers' dwell time and potentially uncovering compromised systems. These tools enable the creation of consistent, repeatable standard operating procedures and playbooks, facilitating effective threat hunting, escalation, and containment of security breaches. The integration of Thinkst Canary and Tines orchestrates a proactive and efficient defense strategy, ensuring high-fidelity breach detection and leveraging existing platforms for comprehensive security management.
Apr 26, 2021
1,389 words in the original blog post.
Subscribing to notifications via the Microsoft Graph API enhances efficiency by automating the process of receiving alerts, such as security notifications and emails, in real time. This process involves creating a webhook to receive notifications, setting up a subscription to specific resources like email inboxes, and renewing the subscription periodically to maintain its validity. The Tines Security Automation platform facilitates this process by allowing users to configure actions that handle the creation, validation, and renewal of subscriptions. Once set up, the system can automatically retrieve and process emails as they arrive, freeing up analysts to focus on more critical tasks. This automated framework not only streamlines alert management but also provides a foundation for further automation, such as integrating with case management systems or sending notifications to team collaboration tools.
Apr 26, 2021
1,403 words in the original blog post.
Phishing remains a leading cause of security breaches, prompting security teams to spend significant time analyzing suspicious emails manually, which detracts from more critical tasks. Phish.ly, a free service developed in collaboration with urlscan, automates the analysis of these emails to alleviate this burden. By forwarding suspicious emails to Phish.ly, the service extracts URLs, submits them to urlscan for analysis, and returns a detailed report covering email classification, sender reputation, and links to analyzed URLs and attachments. The tool also encourages sharing malicious indicators with the InfoSec community by offering an option to distribute these findings to open-source threat intel providers. Users are invited to try Phish.ly, explore its automation capabilities, or provide feedback to improve the service further.
Apr 26, 2021
356 words in the original blog post.
Security management relies on a complex web of trust across systems and endpoints, which can be exploited by malicious entities, requiring enhanced observability and control to manage risks. Datadog's security monitoring offers detection rules for identifying suspicious activities, linking them to the Mitre Att&ck framework, and providing a foundation for threat hunting. Tools like Tines facilitate automation of security workflows, enhancing speed and consistency while reducing human errors and alert fatigue. By integrating with platforms like CrowdStrike, organizations can enrich data from multiple sources to improve threat detection and response. This combined approach allows security teams to efficiently identify, classify, and remediate threats, ultimately building trust and promoting collaboration within organizations.
Apr 26, 2021
1,410 words in the original blog post.
The text discusses the evolution and importance of integrating security into software development, highlighting how past cyber threats prompted a shift towards secure development practices, exemplified by Microsoft's adoption of a Secure Development Life Cycle (SDLC). It emphasizes that while some organizations still overlook security, others see it as a competitive advantage, particularly in the fast-paced Software as a Service (SaaS) environment. The document explains how tools like Snyk and Tines can automate security processes, enabling teams to detect and remediate vulnerabilities efficiently, thereby integrating security seamlessly into the development cycle. The text further illustrates a practical example using Snyk and Tines to manage vulnerabilities in a project, automating the opening and closing of Jira tickets for better tracking and resolution, and emphasizes the potential for broader applications of such automation in security operations.
Apr 26, 2021
1,543 words in the original blog post.
Microsoft Graph offers a robust data repository that can enhance decision-making during threat detection and response, and its integration with Tines allows for advanced security automation. The process involves registering a new application in the Microsoft Azure App Registrations Portal to obtain an app ID and secret, selecting appropriate permissions or scopes, and creating a Tines credential using these details. Security analysts can automate tasks by utilizing Tines' HTTP Request Action, which accesses Microsoft Graph data, such as Outlook emails, through a GET request. This automation streamlines security operations, enabling analysts to focus on more impactful activities while maintaining thorough threat detection and response capabilities.
Apr 26, 2021
900 words in the original blog post.
In a blog series focused on enhancing communication and collaboration within remote teams, this tutorial explores advanced chatbot functionalities in Microsoft Teams, building on prior knowledge of setting up a basic chatbot. It details how to send professional-looking notifications using Adaptive Cards and how to utilize the Microsoft Graph API for proactively contacting users—facilitating the confirmation of suspicious activities, informing teams of incidents, and managing user permissions. The guide addresses the challenge of identifying user IDs without relying solely on email addresses by leveraging team rosters or external tools like DynamoDB. It provides a step-by-step approach to using Microsoft Graph to obtain necessary IDs, enabling chatbots to send proactive messages and alerts. The complete setup is customizable to fit various organizational needs, with a preview of future content on implementing similar features in Slack.
Apr 26, 2021
1,397 words in the original blog post.
Tines, a platform designed for automation, introduced a feature called "Send to Story" in its Autumn 2019 release to enhance efficiency in automation tasks by allowing the creation of reusable "sub-stories." These sub-stories can process events from multiple other stories, adhering to the DRY principle by eliminating redundant action creation. Sub-stories differ from regular Tines stories by having a distinct entry and exit action, with the entry action being a webhook-type and the exit action being a message-only mode event transformation. This system enables seamless data transfer between stories, where a "Send to Story" action can dispatch events to a sub-story, which processes the data and returns it to the originating story. Tines also offers a demo story for URL analysis using urlscan.io, showcasing the practical application of sub-stories in analyzing URLs and returning results. The platform supports automation of various processes like analyzing suspicious files, updating JIRA tickets, and locking user accounts, illustrating its versatility in handling repetitive tasks across different scenarios.
Apr 26, 2021
776 words in the original blog post.
In an on-call scenario, the integration of automation with security operations can significantly reduce stress and enhance efficiency, as illustrated by a security incident managed through PagerDuty. The process involves initiating a SecOps Incident Response (IR) and containment playbook directly from the PagerDuty interface, which enables quick status updates and priority resets. The automation is facilitated by modular workflows that use integrations like CrowdStrike EDR to filter and act on high-severity detections, while still allowing for human oversight at critical decision points. This system employs a scheduling mechanism to automatically run the workflow every 30 minutes, generating alerts only for significant events. By simplifying and automating processes, teams can increase their agility and maintain consistent, repeatable workflows, ultimately reducing risk and improving response times.
Apr 26, 2021
1,037 words in the original blog post.
Tines offers a streamlined approach to automating security processes by breaking them into smaller steps using one of its seven Action types, where each Action performs a function and passes the result to the next until completion. Although this atomic architecture can complicate troubleshooting and time assessment for complex stories, the introduction of Story runs provides a solution by allowing users to trace the exact path an event takes through a Story. This is exemplified by both simple and complex Stories, where users can track Actions and their emitted events chronologically, view and edit Action properties, and assess performance metrics such as start time, end time, and duration. These metrics highlight the efficiency gains of using Tines, such as reducing a phishing response time from 30 minutes manually to 19 seconds with automation. Additionally, the terminology update from "agents" to "Actions" is noted, though visuals may not yet reflect this change.
Apr 26, 2021
420 words in the original blog post.
The Tines Autumn 2019 release introduces the Admin API, which allows tenant admins to manage users, jobs, and private templates programmatically. To use the Admin API, an API key must be generated by tenant admins. The API includes endpoints for user management, such as listing, creating, updating, and deleting users, as well as monitoring user sign-in activity. Job management APIs allow admins to handle tasks like managing queues and retry jobs efficiently. Additionally, the new admin API for private templates facilitates the creation and management of reusable Actions templates for internal use. Further details on the Tines Admin APIs can be found in the documentation section, while a Postman collection is available for testing these API functionalities. It's important to note that "agents" have been renamed to "Actions," although some visuals may not yet reflect this change.
Apr 26, 2021
417 words in the original blog post.
The Tines Summer 2019 Release introduces a variety of new features designed to enhance automation capabilities and user experience for both cloud and on-premise customers. Key updates include Action Templates, which offer nearly 1,000 automation templates for common security tasks, and Private Templates, allowing users to create custom templates for internal use. Other notable improvements include enhanced searching functionality, time-based deduplication to reduce alert fatigue, and the ability to emit duplicate and non-matching events for more nuanced event handling. The release also addresses automation flow interruptions with a retry mechanism for failed HTTP requests, ensuring continuity despite network issues or server rate limits. Additionally, asynchronous event loading improves the user experience by speeding up the preview of large events. These enhancements collectively aim to streamline workflows, improve efficiency, and provide greater flexibility for Tines users.
Apr 26, 2021
1,499 words in the original blog post.
The final part of a three-part series on security automation focuses on the "Respond and Protect" phase, which aims to rapidly address account compromises by leveraging automation. With over 100,000 breaches involving compromised user credentials reported in the 2020 Verizon Data Breach Investigations Report, the necessity for swift action is emphasized. The article outlines a workflow that includes user lockout, case updates, and automated user communication using tools like Microsoft Graph API for account lockout and Slack for user notifications. This approach not only ensures immediate response and user acknowledgment but also updates relevant cases in platforms like TheHive and Jira. By automating these processes, organizations can significantly reduce their exposure window, enhancing their security posture against threats in a matter of minutes rather than days, thereby mitigating risks associated with compromised accounts.
Apr 26, 2021
1,009 words in the original blog post.
Achieving effective team collaboration, particularly for information security (Infosec) teams, involves overcoming various challenges, such as communication barriers and system integration. Infosec Case Management systems, which track and manage security incidents, must be fit-for-purpose and tailored to an organization's unique security landscape. These systems should integrate seamlessly with existing platforms like ServiceNow or Jira, ensuring efficient workflows and maintaining data integrity. Trust in these systems is crucial, as they often involve multiple teams sharing security risks. The decision to adopt a new system or leverage existing ones should consider factors like cost, complexity, and the organization's specific requirements. Ultimately, the goal is to foster collaboration, enhance response times, and support rapid action while maintaining security and trust.
Apr 26, 2021
1,401 words in the original blog post.
Tines addresses the challenge of analyzing .eml files, which contain the raw contents of emails reported as suspicious through phish reporting tools, by developing a liquid filter called eml_parse. This tool extracts and structures data from .eml files, including sender, body, attachments, and headers, allowing for comprehensive analysis similar to that of emails sent to abuse inboxes. The process involves decoding the base64 encoded contents of an .eml attachment using the eml_parse and as_object liquid filters, enabling recursive analysis of .eml attachments within emails. This method simplifies the automation of phishing analysis, making it easy to incorporate into existing workflows and utilize various analysis tools.
Apr 26, 2021
465 words in the original blog post.
Tines, a company founded by former security engineers from DocuSign and eBay, emerged from the founders' frustration with existing security automation platforms that failed to adequately address the increasing volume of security alerts. Tines aims to offer a security orchestration automation and response (SOAR) platform that allows analysts without coding skills to automate complex manual workflows and tasks, such as incident investigation and triage, without relying on prebuilt app-based integrations. This approach enables seamless integration with a wide range of tools, including Carbon Black, to streamline processes like adware detection, phishing automation, and handling macro-enabled malware alerts. Tines’ platform boasts robust open APIs, providing users with extensive actions and customization capabilities, which facilitate efficient threat detection, response, and remediation across various security contexts.
Apr 26, 2021
997 words in the original blog post.
TinesBot is an automation tool within the Tines platform designed to streamline the sharing of threat intelligence indicators by automating the retrieval, analysis, and dissemination of these indicators from various sources such as Pastebin, URLHaus, and Malshare, among others. By leveraging tools like IOC Parser, TinesBot refines and enriches this data, sharing it with platforms like VirusTotal, AbuseIPDB, and Netcraft, thus alleviating the manual, time-consuming process traditionally involved in threat intelligence sharing. The automation not only reduces errors but also ensures that crucial threat indicators are more readily accessible to the infosec community, enhancing the ability of security professionals to detect and prevent attacks. TinesBot's operations highlight the collaborative nature of the security community, which relies on shared data to build better defenses against evolving threats.
Apr 26, 2021
1,125 words in the original blog post.
The text discusses the use of crowdsourcing and automation to enhance application security by verifying user logins through time-based identity checks and user confirmations. It highlights the effectiveness of crowdsourcing for detecting frequent but low-fidelity alerts, such as logins from suspicious IP addresses or unusual locations, termed as 'Impossible Travel.' The process involves using Datadog and Tines to automate the detection of suspicious logins, prompting users via Slack to confirm their activity, and taking appropriate action based on their response. This approach not only stops potential attackers early in their tracks but also optimizes resource allocation and enhances security posture by integrating human responses into automated workflows, thereby increasing situational awareness and improving organizational defenses.
Apr 26, 2021
1,524 words in the original blog post.
Combining APIs and integrations can deliver substantial value by enabling complex tasks through orchestration and automation engines, as demonstrated by a workflow that uploads email text and attachments to AWS S3 and performs security and semantic analysis. Utilizing AWS S3 and AWS Comprehend, the process begins by extracting data from phishing emails and organizing it in S3 using identifiers like the Message-ID for easy retrieval. The workflow includes deduplication, time-based retrieval, and analysis via Hybrid Analysis for threat scoring, followed by appropriate responses to the email submitter. Simultaneously, AWS Comprehend performs NLP to extract entities from the email content, aiding in data mining and improving security awareness by identifying phishing trends. This automated approach, which can be further expanded with additional services, offers scalable, efficient, and adaptable solutions compared to traditional manual methods.
Apr 26, 2021
1,064 words in the original blog post.
Automation offers significant advantages in enhancing productivity and efficiency, particularly in security operations by reducing manual, repetitive tasks and enabling teams to focus on more strategic challenges. Leveraging tools like SentinelOne and Atlassian Jira Service Desk, organizations can automate threat hunting and remediation processes, transforming these into scalable and modular workflows. By breaking down tasks into modular "stories," teams can systematically address Indicators of Compromise (IoCs), such as suspicious domain traffic, by employing automation tools like Tines to streamline actions and ensure consistent, reliable outcomes. This approach not only improves the speed and accuracy of responses but also fosters better collaboration across different teams by integrating with existing platforms and creating audit trails and task assignments. Ultimately, automation allows teams to shift from reactive to proactive postures, optimizing both functional and cultural aspects of their workflows.
Apr 26, 2021
1,278 words in the original blog post.
AWS Security Hub provides a centralized platform for AWS customers to monitor their security and compliance status by aggregating, organizing, and prioritizing findings from various AWS services and partner products. Despite concerns about potential costs due to the numerous AWS Config rules it can generate, the consolidation of security information from services like Amazon GuardDuty and Amazon Inspector offers significant advantages for enterprise security teams. The integration with Tines allows for the automation of responses to security findings by sending notifications to Tines, where they can be enriched, prioritized, and managed. This is achieved by enabling AWS Security Hub to send CloudWatch Events to Tines, with the help of a CloudFormation template that simplifies the setup process. The system automates the confirmation of SNS subscriptions and facilitates the parsing of security findings into a usable format for further automation within Tines.
Apr 26, 2021
623 words in the original blog post.
In the second part of a series on security automation for combating account compromise, the focus is on enrichment and case management following detection. It highlights the growing threat of misconfigurations, as reported by the 2020 Verizon Data Breach Investigations Report, and emphasizes the importance of rapid response to minimize exploitation windows. The process involves leveraging the HaveIBeenPwned API and other services to enrich data about compromised emails and automate case creation for both Helpdesk and Infosec teams. The enrichment process gathers detailed breach information, checks if compromised emails have been used elsewhere using emailrep.io, and packages this data into incident cases. The separation of duties between teams ensures sensitive information is handled appropriately, and individual cases are created for each compromised account. This setup facilitates tracking and operational actions, such as locking user accounts and terminating sessions, while integrating with case management systems like TheHive and Jira Service Desk to improve collaboration and reduce Mean Time to Respond (MTTR). The series will continue with a focus on active response and user engagement in Part 3.
Apr 26, 2021
1,212 words in the original blog post.
Tines, a Security Orchestration, Automation, and Response (SOAR) platform, proudly sponsors URLScan.io, a website scanner founded by Johannes Gilger that analyzes and classifies nearly 100,000 URLs daily. This collaboration highlights URLScan's comprehensive analysis capabilities, including HTTP request data, domain interactions, and SSL certificate detection, all accessible via a user-friendly API. Tines leverages this API to automate URL scanning and threat intelligence sharing, enhancing efficiency for security teams. The partnership is rooted in Tines' founders' experiences dealing with phishing threats and their appreciation for URLScan's robust API. By making it convenient for users to integrate URLScan into their workflows, Tines aims to support the security community in safeguarding against malicious URLs and sharing valuable threat intelligence.
Apr 23, 2021
1,330 words in the original blog post.
Microsoft Graph provides extensive data access useful for organizations leveraging Office 365 to enhance decision-making in threat detection and response, and this guide outlines how to enable Tines for Microsoft Graph security automation. The process involves registering a new application in the Microsoft Application Registration Portal to obtain an app ID and secret, selecting the appropriate platform, and setting up a redirect URL for authentication responses. Permissions, or OAuth2.0 scopes, are defined to allow the application to perform necessary tasks, such as reading Outlook emails. A Tines credential is then created with the app's ID and secret, and a list of permissions is included to facilitate secure access to Microsoft Graph data. Once these steps are completed, a Tines Action is set up to connect with Microsoft Graph and automate tasks like reading emails from an Outlook account, thereby allowing security analysts to perform thorough threat detection and response while freeing up resources for other high-impact activities.
Apr 23, 2021
990 words in the original blog post.
Malware analysis is a critical component of security operations and incident response, involving the examination of suspicious files using techniques such as static and dynamic analysis. While manual analysis by experienced engineers remains superior, automation through sandboxes like Any.Run, Hybrid Analysis, and Cuckoo Sandbox can streamline repetitive tasks, allowing teams to work more efficiently. However, full automation has its limitations, as sophisticated malware can detect sandbox environments or require multiple applications to trigger. Sandboxes allow for interactive analysis, providing a balance between manual and automated processes. Automating the upload and analysis of files using platforms like Tines can enhance efficiency, with potential applications including the identification and blocking of malicious files, domains, and IPs, as well as integrating results into security platforms such as VirusTotal for comprehensive threat detection. Ultimately, automation aids in rapidly assessing threats, enabling security teams to allocate resources to more impactful activities and reduce risk, though a tailored approach dependent on specific environments and risk tolerance is advised.
Apr 23, 2021
1,344 words in the original blog post.
Google has launched the G Suite Alert Center to provide G Suite customers with a centralized view of alerts and notifications regarding security threats, enhancing the ability of administrators to manage and respond to potential risks. The Alert Center is integrated into the G Suite Admin portal, allowing users, especially those on the Enterprise plan, to not only view alerts but also take remediation actions directly. To maximize the utility of the alerts, the article discusses integrating the Alert Center with security orchestration, automation, and response (SOAR) platforms like Tines, which enables the automation of threat detection and response processes. This integration allows for real-time remediation and a unified security response process, leveraging the Alert Center's data as a critical component of a comprehensive threat detection strategy. The setup involves creating service accounts, enabling relevant APIs, and authorizing these accounts within G Suite to facilitate interaction with the Alert Center API. This automated approach enhances security operations by improving detection speed, reducing errors, and allowing for seamless integration with other threat intelligence sources.
Apr 23, 2021
1,328 words in the original blog post.
No code platforms are gaining popularity as they enable diverse skill sets to contribute to problem-solving, free up staff time, and allow those who understand issues best to devise solutions, according to Tines cofounder Eoin Hinchy. This trend is partly driven by the increasing difficulty in finding software engineers willing to work on these types of problems.
Apr 23, 2021
95 words in the original blog post.
Part two of the Automating abuse inbox management and phishing response video series expands on the initial introduction of Tines by enhancing the Story with advanced capabilities. The new features include attachment analysis using VirusTotal, real-time detonation of attachments via Hybrid Analysis, URL analysis through URLScan.io, and the collection of user responses using Tines' Prompt Widget. The series also highlights a recent terminology update, where "agents" are now referred to as "Actions," though some visuals may still reflect the former term. The video series aims to provide a more robust and automated approach to managing phishing threats.
Apr 23, 2021
164 words in the original blog post.
Analyzing email headers is a vital technique in combating phishing as they provide essential information about an email's route and origin, which can help determine its legitimacy. As phishing techniques become increasingly sophisticated, using tools like Tines to automate the analysis of these headers is crucial. Email headers can reveal details such as the sender's IP address, the servers involved in sending the email, and whether the message passed authentication checks like DMARC, DKIM, and SPF. Key fields to analyze include the 'Message-ID', which can identify botnet activity, 'Authentication-Results' for authentication status, and 'Trace Fields' like 'Received' and 'Return-Path' to trace the email's path. Platforms like Microsoft Office 365 and Gmail offer methods for extracting and analyzing these headers, allowing organizations to automate the detection of potentially malicious emails.
Apr 23, 2021
1,764 words in the original blog post.
The text discusses the challenges and solutions related to the integration capabilities of Security Orchestration Automation and Response (SOAR) tools, emphasizing the limitations of the prevalent app-based integration model. This model relies on pre-built apps to connect with various external tools, which can be problematic as it limits flexibility and requires continuous updates from vendors, metaphorically described as the "crayon problem." With the increasing number of security tools enterprises use, this model poses significant challenges, especially when custom or bespoke tools are involved. To address these issues, the Tines security automation platform offers a direct integration model through its HTTP Request Action, enabling seamless connections with any tool, regardless of its nature, thus eliminating the dependency on pre-built apps and expanding integration possibilities without needing significant software development expertise.
Apr 23, 2021
518 words in the original blog post.
The text provides a comprehensive exploration of the VirusTotal API, discussing its public and private versions, with a focus on the public API's capabilities, limitations, and setup process. It outlines how to obtain an API key, which is necessary for making queries, and details various ways to interact with the API, such as retrieving file and URL scan reports, rescanning files, and adding comments to files or URLs. The text also demonstrates how to use the API with cURL, Postman, and Tines for automated workflows, offering examples for each tool. Furthermore, it highlights the API's rate limiting and suggests methods to handle it using Tines' automation features, showcasing practical applications in security automation, especially in managing phishing threats and abuse inboxes.
Apr 23, 2021
1,590 words in the original blog post.
Tines offers a solution for enterprise-level companies by simplifying the response process to cyberattacks, which are typically managed by security professionals using automated tools. These tools, however, often produce excessive noise and false alarms. Tines mitigates this issue by automating numerous manual responses to alerts, allowing security personnel to focus on critical tasks. The platform's drag-and-drop interface is accessible to non-coding team members, such as security analysts, enhancing efficiency. Additionally, with remote work becoming the norm, Tines makes technical roles more attractive by reducing tedious tasks and contributing to a competitive job landscape.
Apr 23, 2021
142 words in the original blog post.
Tines, a company known for its automated platform that eliminates repetitive tasks for engineers and analysts without requiring technical coding, tripled its revenue last year, even during the pandemic, as security teams increasingly adopted its solution to manage numerous security alerts effectively. The recent $26 million funding round aims to expand Tines' reach beyond cybersecurity into areas such as DevOps and IT, differentiating it from competitors like Palo Alto Networks and Splunk, whose automation tools are more narrowly focused on security-specific applications.
Apr 23, 2021
113 words in the original blog post.
The process of automating trial creation at Tines is facilitated through a Tines Story, which involves several steps from the initial request to the final setup. When a user requests a trial instance, their details are sent via a Webhook to initiate the process, which includes creating a new tenant using Digital Ocean's infrastructure. A custom provisioning script is generated to ensure each tenant has the latest product version, and once the instance is deployed, it is renamed and linked with a DNS entry for access. The system checks for successful execution through specific trigger actions, and if any issues are detected, support is notified for manual intervention. Upon successful setup, users receive a welcome email, and their details are recorded in the CRM for future tracking, showcasing an early phase of Tines' DevSecOps program for managing trials.
Apr 23, 2021
468 words in the original blog post.
AWS DynamoDB is gaining popularity among security teams due to its key-value storage, simplicity, scalability, and security features, making it ideal for data storage tasks in security operations and incident response, especially for those already utilizing AWS. The post details how security teams can integrate Tines with DynamoDB by creating an IAM user with necessary permissions and configuring a Tines AWS credential for authentication. This setup allows Tines to perform various DynamoDB actions, such as listing tables, scanning tables with filters, creating and deleting tables, and managing items within tables. By incorporating DynamoDB actions in Tines automation stories, security teams can efficiently access and store critical data, enhancing their ability to investigate and respond to security incidents.
Apr 23, 2021
700 words in the original blog post.
In the blog, Tines.com discusses how organizations can efficiently share threat intelligence indicators of compromise (IOCs) across multiple platforms using their Security Orchestration, Automation, and Response (SOAR) platform. Tines simplifies the process of distributing IOCs to popular threat intelligence platforms such as AlienVault, Trustar, Facebook Threat Exchange, and others, by automating the sharing process and eliminating the need for pre-built integrations. The platform allows security teams to easily create "Stories" and "Actions" to manage the sharing process without additional coding, facilitating integration with various tools in a company's security stack. This approach not only streamlines the sharing of threat intelligence but also enhances collaboration and data integration, helping detect and mitigate malicious activities more effectively. The blog emphasizes the importance of using platforms that peers also utilize, with features such as Rest APIs for seamless integration, and highlights the ability to automate the creation and updating of threat intelligence entries across different platforms, thereby improving the quality and accessibility of threat data.
Apr 23, 2021
2,334 words in the original blog post.
Security teams often face the challenge of data leaks and information disclosure, particularly when employees inadvertently commit sensitive data to public platforms like Trello or GitHub. A significant, yet less recognized, source of data leaks occurs when security teams use "sandboxes" to analyze potentially malicious URLs and files. These sandboxes, designed to automate threat detection, often make analysis results publicly searchable, inadvertently exposing sensitive information submitted by users. Issues arise when legitimate URLs or files leading to sensitive data are submitted, potentially making confidential information accessible. The text highlights examples of such leaks, including corporate email addresses and password reset links found in sandboxed URLs, and documents from file-sharing and electronic signature services. While sandboxes are valuable for quick threat analysis and understanding attack patterns, the unintentional exposure of sensitive data poses a risk. To mitigate these risks, security teams are advised to use sandbox features that prevent public storage of results, replace sensitive information with placeholders before submission, and proactively manage sensitive content that has been exposed.
Apr 23, 2021
988 words in the original blog post.
End-to-end testing for web applications can be challenging, particularly when setting up test data, but using a fixture factory library like FactoryBot can help streamline the process by sharing backend fixture libraries with the frontend. This approach ensures the creation of realistic and appropriate test data that aligns with system expectations, thereby enhancing the quality of end-to-end (E2E) tests. By automating these tasks, it allows the tests to mimic real user interactions with the application more accurately, testing the data flow, network requests, and service interactions. Unlike traditional methods that rely on stubbed objects or application snapshots, the use of FactoryBot in E2E testing involves making real network requests and database queries, which reduces maintenance costs and increases the likelihood of catching bugs across both frontend and backend. This method, adopted by Tines using Playwright for browser automation, results in a more accurate representation of user interactions and supports the philosophy of true end-to-end testing by ensuring that the data created during tests reflects real user actions.
Apr 21, 2021
1,151 words in the original blog post.
Tines recently decided to overhaul its CSS approach due to the previous lack of a cohesive strategy, which included a mix of Tailwind, SASS, CSS modules, and inline styles, causing inefficiencies and hindering the implementation of features like dark mode. The team evaluated various CSS methodologies and ultimately chose the CSS-in-JS approach, specifically Linaria, for its build-time dependency feature, which minimizes run-time risks and complexity. This decision was based on the need for a more unified styling strategy that enhances readability and maintainability, while also aligning with Tines' existing investment in TypeScript and the desire for type safety in styling. As a result, the team has begun migrating their codebase away from Tailwind and CSS modules, finding the new approach more intuitive and conducive to future developments, such as dark mode, while also celebrating progress through a dedicated Notion page tracking ongoing migrations.
Apr 20, 2021
1,656 words in the original blog post.
In a Rails application, traditional approaches such as the "Fat Model, Skinny Controller" method often lead to challenges when handling complex business logic, prompting developers to seek alternative solutions like service objects. These service objects, typically housed in directories like app/services, provide a structured way to manage code that interacts with multiple models and performs various tasks. However, as applications grow, these structures can become cumbersome due to increased interconnectedness and lack of encapsulation, complicating maintenance and updates. The text argues for a shift in mindset, suggesting that developers should prioritize their business logic over fitting into Rails' predefined structure. By using Ruby modules and classes in the top-level lib directory, separate from the framework-centric app directory, developers can better capture the business domain without being constrained by the Rails framework. This approach emphasizes using Rails as a tool to serve the application rather than confining the application within the Rails framework, allowing for more effective modeling of the application's domain.
Apr 16, 2021
1,095 words in the original blog post.
Tines is an Irish cyber security start-up recognized for its innovative approach in the Ones to Watch section, focusing on Security Orchestration Automation and Response (SOAR). Founded by Eoin Hinchy, Tines offers a platform designed to enhance information security by automating and orchestrating security operations.
Apr 05, 2021
64 words in the original blog post.
Tines, an Irish cybersecurity startup founded by Eoin Hinchy in early 2018, is quickly gaining traction with its innovative approach to dealing with cyber attacks. The company has already attracted high-profile clients such as Bank of Ireland, McKesson Inc, and Docusign, underscoring the growing necessity for cybersecurity investments across businesses. With aspirations of expanding into the United States, Hinchy envisions the potential to grow Tines into a billion-euro enterprise within the expansive cybersecurity market.
Apr 05, 2021
124 words in the original blog post.
In a weekly startup spotlight series, the article profiles a cybersecurity company, highlighting its activities and contributions to the field. Published on April 5, 2021, it provides insights into the company's operations and achievements. Despite being over 18 months old at the time of access, the article remains a part of the series dedicated to showcasing innovative startups.
Apr 05, 2021
54 words in the original blog post.
Irish cybersecurity start-up Tines aims to revolutionize the way companies respond to cyber-attacks with its latest product. Tines provides a security orchestration automation and response platform that enables information security teams to automate repetitive and manual tasks, enhancing their effectiveness and efficiency. Notably, the platform allows users without coding or development experience to automate complex tasks, potentially transforming organizational responses to cybersecurity threats.
Apr 05, 2021
78 words in the original blog post.