Tines

Tines is a London-founded no-code automation platform launched in 2018 that positions itself squarely at the intersection of security operations and workflow automation. Built to reduce manual toil in SOCs and security teams, Tines lets users build event-driven “stories” — sequences of actions and triggers — via a visual canvas rather than traditional scripting. The company emphasizes security controls such as per-action credentials, audit trails, and role-based access to ensure automation itself meets compliance and incident-handling requirements. By focusing on security use cases rather than generic automation, Tines claims to lower MTTR and reduce alert fatigue for security practitioners.

The platform’s core features match its security-first focus. The visual story canvas supports four primary action types: HTTP requests (flexible API calls with headers, body templates, and credential binding), Transformers (JSON parsing and field extraction using Jinja-like templates), Conditional actions (if/else branching and event routing), and Connectors (pre-built integrations for ticketing, EDR, SIEMs, and cloud providers). Tines also includes a credentials vault for encrypting API keys per story, robust audit logging showing who executed or edited stories, and a scheduler for recurring tasks. Recent updates added a built-in message bus (event queueing to avoid dropped events) and outgoing webhook reliability features for guaranteed delivery and retry policies.

Tines’ pricing is tiered and intended for a range from small teams to global enterprises. A free Community tier exists for evaluation with limits (single-user or small-team constraints, limited stories and connectors). Paid pricing is not fully self-service beyond a Starter/Pro offering; the public site lists a Professional/Team tier starting around a documented quote-based monthly price for more connectors, team seats, and SLAs, while Enterprise is custom-priced and includes SSO, dedicated support, and contract terms. The free tier is suitable for proof-of-concept work; paid plans unlock multi-user collaboration, higher event throughput, SSO, and enterprise compliance features. Exact per-seat and throughput pricing is typically provided during sales conversations for Pro and Enterprise tiers.

Security engineers, SOC analysts, and automation specialists are the primary users of Tines. A SOC analyst uses Tines to automate triage and enrichment, reducing analyst time per alert by extracting IOC details and enriching them across threat feeds. A security engineer uses Tines to orchestrate automated containment workflows, such as disabling user accounts and creating tickets in ServiceNow. Real-world workflows include phishing triage, vuln alert enrichment, and automated remediation. Compared to a generic iPaaS like Zapier, Tines differentiates by offering per-story credential isolation, audit-centric design, and event durability tailored to security operations rather than broad business automation.