January 2025 Summaries

Each quarter, Tines showcases new features with insights from engineers, designers, and product managers, highlighting visual updates, conditional page elements, array management with the LOOP option, AI provider choices, and mobile cases. The platform now allows users to select their preferred AI provider, with a new library story comparing prompts across LLM models and an updated Workbench for suggested interaction replies. In the Builder Corner, users can preview action outputs, enhancing automation task quality, a feature that gained attention at the Tines tech summit. The Admin Corner offers tenant admins improved flexibility and control, enabling additional team members to review change requests and expedite workflow updates. Tenant owners can easily access draft stories and manage user sessions through the user management API.

Automated incident response offers significant advantages, such as reducing response times and scaling solutions to fit an organization's infrastructure, yet it also raises complex questions about which processes to automate and how to balance automation with human oversight. Organizations must navigate these challenges by tailoring automation strategies to their unique needs, involving stakeholders, and defining the scope of projects. Effective implementation involves several best practices, such as mapping infrastructure dependencies, starting with well-defined environments, and creating a list of potential automated actions. The article suggests using tools like the SOC Automation Capability Matrix to streamline the process and emphasizes a phased approach of crawling, walking, and running to gradually build confidence in automation while minimizing disruption. This method involves starting with simple, repeatable tasks, then progressing to more complex orchestrations that enable autonomous decision-making, all while continuously engaging with stakeholders to align actions with organizational goals.

In a webinar featuring Andrew Green, Networking & Security Research Analyst at GigaOm, the discussion centered around the evolving role of SOAR (Security Orchestration, Automation, and Response) in the context of modern security challenges and the potential integration of AI. Despite Gartner's Hype Cycle for ITSM report labeling the SOAR category as "obsolete," both Green and the host emphasized the continued importance of SOAR, critiquing traditional platforms for not keeping pace with current security needs. They explored the limitations and potential of AI within SOAR, highlighting that while AI can greatly assist with tasks like data summarization and threat intelligence, it struggles with tasks requiring deep contextual knowledge. Accountability in AI-driven decisions was also discussed, with the consensus being that while AI can act as a valuable assistant, it should not yet be fully relied upon for autonomous decision-making. The conversation also touched on different types of SOAR vendors and how AI implementations can be refined to ensure accurate outputs, suggesting a future where AI complements human expertise rather than replaces it.

In a recent webinar, Matt Woodruff, the Worldwide Industry Lead for Security and Compliance at Jamf, discussed with Sif Baksh the challenges IT teams face with remote work security, particularly within the Apple ecosystem, and how integration with Tines can streamline device management and enhance security. The conversation highlighted the importance of Zero Trust Network Access (ZTNA) practices and the evolving nature of IT budgets in response to the pandemic's push for remote work, leading to an increased adoption of Bring Your Own Device (BYOD) policies. The integration of Tines' orchestration and automation platform with Jamf's device management tools aims to optimize security and operational efficiency by customizing workflows and automating updates, while also addressing the need for training on Apple devices. This partnership also explores the secure adoption of AI tools and emphasizes the importance of orchestration to ensure seamless integration of multiple products, which is crucial for maintaining a secure and efficient IT infrastructure in the post-pandemic era.

Tines emphasizes the importance of both flexibility and security in their platform, particularly when integrating AI models, by providing secure and private AI capabilities without data logging or internet transit. When using pre-trained foundation models from reputable providers like OpenAI or Anthropic, users should ensure compliance with data protection requirements, while those building their own models are advised to employ threat frameworks like the OWASP Top 10 for LLM Applications. Securing AI model serving providers involves using standardized REST APIs and considering factors such as authentication and encryption, with guidance from the OWASP Top 10 for Web Applications. For Tines customers, encrypted communication between model serving providers and Tines is crucial, alongside following best practices for API key management. Tines ensures data security by not using customer data for AI training and providing robust governance features, allowing customers to confidently integrate AI into their workflows while maintaining security and control.

Tines has announced the ability for users to select their preferred AI model to handle workflows within its platform, enhancing flexibility and customization. Since the introduction of AI features in Tines in May 2024, the company has aimed to simplify building, running, and monitoring workflows through secure and private AI, including a chat interface called Workbench. By default, Tines AI features are powered by Anthropic's Claude and AWS Bedrock, but users can switch to other LLMs that conform to OpenAI or Anthropic schemas, allowing for a tailored AI experience. Matt Muller, Field CISO at Tines, emphasizes the importance of security and provides recommendations for using AI responsibly, such as ensuring data protection and using strong encryption. Integrating a preferred AI model is straightforward and involves entering an API key, with resources available for guidance on setup and discussions with Governance, Risk, and Compliance teams.

Tines has announced its commitment to CISA's Secure by Design pledge, emphasizing its dedication to developing secure software without compromising on automation capabilities. The pledge consists of seven principles aimed at enhancing foundational software security, and Tines outlines its current and future investments in these areas. These include increasing the use of multi-factor authentication, eliminating default passwords, reducing vulnerability classes, ensuring timely security patches, publishing a vulnerability disclosure policy, being transparent in vulnerability reporting, and enhancing capabilities for gathering evidence of cybersecurity intrusions. Tines leverages its robust CI/CD pipelines, Ruby on Rails application framework, and partnerships with platforms like BugCrowd to meet these objectives. The company is committed to transparent communication with its customers about security issues and plans to provide regular updates on its progress in championing these security principles.

Connor Brewer, Principal Solutions Architect at Uzado, introduces an innovative IT help desk app created with AI in Tines, highlighting its potential to revolutionize workflow orchestration and automation in IT and security services. The app addresses inefficiencies in ticket handling by automating responses to routine IT requests, such as resolving audio issues during meetings, which constitute around 20% of all tickets. By streamlining these processes through AI triage and automated responses, the app saves significant time for L1 analysts, allowing them to focus on more complex tasks, while providing users with immediate solutions. This approach not only enhances user experience but also optimizes costs by reducing manual intervention in routine tasks. The app's flexibility allows it to be adapted across various departments, such as security and DevOps, further expanding its applications and impact.

Generative AI, as explored by Eric Newcomer, Principal Analyst at Intellyx, presents significant potential for enhancing workflow automation, particularly in areas like security operations and incident management. Despite its transformative capabilities, such as summarizing text and iterating through known bodies of text, generative AI is limited by issues like hallucinations, inaccurate answers, and biases, necessitating human oversight to confirm and correct AI outputs. The integration of AI, like the Workbench product in Tines' platform, demonstrates its practical application in automating Security Operations Center (SOC) and IT workflows, reducing manual effort and analyst fatigue by managing vast volumes of log and event data. By offering a secure, private interface for security analysts to triage incidents and confirm proposed actions, Tines effectively harnesses AI to streamline processes while maintaining essential security and privacy controls. This integration highlights the natural fit of generative AI in automating complex workflows, illustrating its potential to enhance productivity and reduce the burden on human operators in data-intensive environments.

The text provides an overview of recent enhancements in Tines, focusing on improving user interaction and customization. Tines applications now offer more interactive features, such as search and multi-selection capabilities, while a new JSON mode ensures AI model outputs are well-structured. The integration of Amazon's AI models and availability for self-hosted tenants is highlighted. The LOOP option facilitates array processing by enabling data transformation and aggregation. Enhancements in the Cases feature include linked case templates, mobile view for cases, customizable action order, and record ID visibility. Additionally, other updates include time range filters for event search, visual change requests, direct action linking, and updates to the AES_ENCRYPT function. Despite the holiday season, the Tines team has actively introduced these new features.