July 2024 Summaries

Tines introduced a case management solution in early 2023 to help security teams address both known and new threats through automation and collaboration. Over the past year, this feature has evolved into a platform where teams can manage, track, and report on workflows, fostering a center of excellence for workflow automation and risk mitigation. Key updates include AI integration for real-time alert context updates, customizable case creation, performance dashboards, and case SLAs to prioritize tasks. The platform emphasizes flexibility and accessibility, allowing users to customize roles, permissions, and case management processes to fit their needs. Additionally, live interactions, case groups, and a Case Manager role enhance team collaboration and efficiency, supporting a better handling of unknown threats and reducing potential burnout. Tines provides resources like webinars and documentation to help users optimize their case management experience.

Tines offers several enhancements to improve workflow efficiency and security management, including the use of Webhook rules to generate events from specific requests and the ability to filter responses with regex. For critical resources, Tines provides a locking mechanism that allows only authorized team admins to unlock and edit these resources, ensuring their protection. Recent updates in case management focus on enhanced collaboration and efficiency, with features like case groups for controlled user access, seamless case transfers, granular permissions, and custom SLA settings. To aid organization, a clickable table of contents is available for navigating detailed case descriptions, along with a new comment filter on the Case List page or Dashboard for easier case search based on comments.

Kelsey Sevening, Sr. Manager of Project Management at Tines, outlines what clients can anticipate from engaging with Tines' professional services, emphasizing a commitment to high-quality outcomes and a thorough delivery process. The services offered span advisory, automation workshops, use case development, technical training, and onboarding, with a focus on building automated workflows, or 'stories,' through a five-phase engagement process. This process begins with scoping, where the team collaborates with clients to define story initiation and workflow details, followed by diagram review and story building, review and feedback, user acceptance testing, and change control. The aim is to streamline client operations by transforming current processes into efficient automated workflows while allowing for feedback and adaptation to meet evolving needs. For successful implementation, clients are encouraged to prepare by identifying goals, ensuring access to necessary credentials, and documenting workflows and team roles.

Martin Moroney, the Customer Success Engineering Manager at Tines, discusses the complexities and advantages of migrating from legacy SOAR (Security, Orchestration, Automation, and Response) platforms to more sustainable solutions. He argues that while daunting, such migration is justified by the need for improved usability, agility, and integrations, along with the evolving threats that security teams must counter. The blog shares insights into the planning and execution of successful migrations, emphasizing meticulous preparation, which includes understanding existing workflows, setting clear objectives, and ensuring adequate training. Case studies from companies like Beyon Cyber and Mars highlight the tangible benefits of migration, such as performance improvements and enhanced workflow flexibility. Moroney stresses the importance of careful planning and collaboration between customers and vendors to ensure a smooth transition, ultimately reclaiming time and improving operational efficiency.

Tines software engineer Shayon Mukherjee recounts an incident involving a Redis cluster upgrade that revealed a hidden bug in the platform's webhook system, highlighting the importance of comprehensive testing and platform resilience. During the upgrade, a connectivity issue in the dedicated listener thread for Redis Pub/Sub led to service degradation, as new webhook requests could not be processed. This incident exposed a critical vulnerability in the system's architecture, particularly the reliance on a single listener thread without a robust fail-open mechanism. The experience underscored the necessity for a holistic view of system dependencies and resilience, prompting Tines to implement improvements such as reconciliation loops for the singleton thread and periodic chaos testing to better withstand similar issues in the future. Mukherjee emphasizes that incidents are inevitable in complex systems and serve as valuable opportunities for learning and improvement.

Workflow automation offers significant benefits for security teams, including enhanced incident readiness, faster value realization, improved retention, and reduced errors, yet misconceptions often hinder its adoption. Common myths such as the complexity of scripting, inadequacy for complex workflows, fears of replacing personnel, rash decision-making, and difficult integration are addressed. Modern workflow automation platforms, particularly no-code solutions, empower all team members to build and manage workflows, allowing technical users to focus on outcomes rather than coding. These platforms facilitate collaboration and scalability, provide robust security features, and ensure human oversight in critical decisions. Automation enhances team efficiency by freeing members from repetitive tasks, enabling them to focus on high-impact work and maintain engagement. Additionally, seamless integration with tools like JIRA and Slack maximizes organizational data and resources, supporting a more cohesive and effective security strategy.

Tines provides a structured onboarding experience to assist customers in building their first automated workflows, emphasizing the importance of dedicated build sessions with a Customer Success Engineer (CSE) and Customer Success Manager (CSM). These sessions are designed to familiarize users with Tines, teach best practices, troubleshoot issues, and quickly get workflows ready for production. The process involves sharing screens with expert guidance, implementing trigger logic, data manipulation, error handling, and more. To maximize the effectiveness of these sessions, customers are encouraged to prepare by identifying responsible builders, framing their use case, familiarizing themselves with the user interface, setting up credentials, and noting down questions. Post-session, clients are advised to clarify next steps, continue building workflows, and reach out for further assistance if needed, ensuring a supportive and productive onboarding journey.

The text outlines a comprehensive guide for security teams on effectively implementing workflow automation to enhance efficiency, team retention, and error reduction. It emphasizes the importance of establishing clear objectives, identifying internal champions to gain stakeholder support, and thoroughly evaluating suitable platforms that align with specific use cases and integrate well with existing tools. The guide advises running a proof of concept to test platform capabilities, scrutinizing AI-powered features for practicality and cost-effectiveness, and making informed purchasing decisions by understanding pricing models. It advocates for an iterative approach in building workflows, starting with simple prototypes and gradually increasing complexity to adapt to changing processes and threats, while maintaining and evolving these workflows over time.

The "You Did WHAT With Tines?!" competition is back, encouraging the Tines community to showcase their innovative and creative workflows using the platform's features, particularly its new AI capabilities. With over 750 pre-built workflows, including 75 user submissions, the Tines library serves as an inspiration and resource for users. This year's competition invites participants to submit their stories in various categories such as AI efficiency and everyday workflows, with the chance to win exciting prizes, including a trip to New York City for the top winner. Submissions are open until August 20, 2024, and will be added to the community library under the "YDWWT" tag. Last year's winner, Tyler Talaga from MyFitnessPal, impressed with a macOS Patch Management solution that effectively managed software updates through Tines.

Navigating the landscape of AI tools and workflow automation requires a discerning approach to distinguish between genuine utility and superficial appeal. Many AI features, although impressive in controlled demos, often fall short in real-world applications due to rushed development. Key considerations when evaluating AI tools include assessing security and privacy measures, determining return on investment, accuracy, speed, model selection, scalability, usability, and longevity. It is crucial to establish clear goals, conduct thorough research, attend demos prepared with relevant queries, and take advantage of free trials to test the tools in realistic conditions. Additionally, understanding the pricing model, ensuring policy and compliance alignment, and evaluating the tool's future potential are essential steps in making an informed purchase decision. By following a structured evaluation process, organizations can select AI tools that are genuinely impactful and aligned with their business objectives.

Initially skeptical about AI's impact on cybersecurity due to past disappointments with overhyped technologies, the author’s perspective shifted after witnessing AI’s practical applications in Tines, a workflow automation platform. Although early AI security tools often failed to deliver in real-world scenarios, advancements in large language models since 2022 have demonstrated tangible benefits, such as automating complex tasks like converting timestamps. The author emphasizes the importance of AI tools in enhancing productivity and reducing barriers, while maintaining human oversight for reliability and security. Tines' AI features, designed to improve workflow creation and monitoring, have shown promise in increasing efficiency and accessibility for users. Despite the optimism, the author advises a cautious and gradual integration of AI in areas with minimal risk, advocating for a trust-building approach that allows for controlled interaction with AI to ensure privacy and security.