Description
Import a new story. Note that if the story data includes embedded substories these will not be imported.
Request
HTTP Method: POST
| Query Parameter | Description |
|---|---|
| new_name | The new name for the story. |
| data | JSON object representing the story in exported form |
| team_id | ID of team to which the story should be added. |
| folder_id | Optional ID of folder to which the story should be added. |
| mode | Optional Create a new story or update existing by Name (new, versionReplace) default: new |
curl -X POST \
https://<<META.tenant.domain>>/api/v1/stories/import \
-H 'content-type: application/json' \
-H 'Authorization: Bearer <<CREDENTIAL.tines_api_key>>'
-d '{
"new_name": "Imported story",
"team_id": 2,
"folder_id": 1,
"data": {
"schema_version": 18,
"standard_lib_version": 41,
"action_runtime_version": 6,
"name": "Simple story",
"description": "In the simple story we will create a fictional situation where a detection system is configured to send alerts to our Tines tenant. The alert will contain the type of alert (infection, ddos, credential stuffing, etc.) and details on any users affected. If the alert is related to an infection, based on the users job title, we will take a specific action.\r\n\r\nThe simple story is described in detail in the Tines Docs(https://hub.tines.com/docs/quickstart/simple-story/).\r\n\r\nUse the following URL command (replace $webhook-url with the webhook URL in the ''Summary\" tab of the 'Receive events' action) to send events to this story:\r\n\r\ncurl $webhook-url -X POST -H \"Content-Type: application/json\" -d '{\"event_name\":\"My first event\",\"type\":\"infection\",\"users\":[{\"name\":\"alice\",\"age\":25,\"country\":\"US\",\"job\":\"Engineer\"},{\"name\":\"bob\",\"age\":20,\"country\":\"UK\",\"job\":\"Student\"},{\"name\":\"carol\",\"age\":61,\"country\":\"Ireland\",\"job\":\"CEO\"}]}'",
"guid": "8de58314250ff167127d6ae213711de9",
"slug": "simple_story",
"agents": [
{
"type": "Agents::TriggerAgent",
"name": "User is ceo",
"disabled": false,
"description": null,
"guid": "9fda86d826c2da6b1001d83de774e6cd",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"rules": [
{
"type": "regex",
"value": "ceo",
"path": "<<explode_users.user.job>>"
}
]
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null
},
{
"type": "Agents::EmailAgent",
"name": "Notify by email",
"disabled": false,
"description": null,
"guid": "2a1c3710c175566adbac7bdfcb8aa0af",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"recipients": "tinesdemouser@outlook.com",
"subject": "Engineer in infected",
"body": "Hello,<br/><br/>An alert has been detected that relates to an infected engineer. The user's details are shown below:<br/><b>Name:</b> <<explode_users.user.name>><br/><b>Age:</b> <<explode_users.user.age>><br/><b>Country:</b> <<explode_users.user.country>><br/><br/>Thanks!"
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null,
"schedule": null
},
{
"type": "Agents::WebhookAgent",
"name": "Receive events",
"disabled": false,
"description": null,
"guid": "2f1f4538338172e208f653d3a614afb6",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"secret": "201367c22bd83f4e79ac81aa9f9efb7c",
"verbs": "post",
"path": "faac546b6297d276b866af0487343601",
"include_headers": "false"
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null
},
{
"type": "Agents::TriggerAgent",
"name": "Type is infection",
"disabled": false,
"description": null,
"guid": "e606d66f945ba059655a672497d78170",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"rules": [
{
"type": "regex",
"value": "infection",
"path": "<<receive_events.type>>"
}
]
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null
},
{
"type": "Agents::EventTransformationAgent",
"name": "Explode users",
"disabled": false,
"description": null,
"guid": "51ce4f788c04cf81dc7eb7dda25f575b",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"mode": "explode",
"path": "=receive_events.users",
"to": "user"
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null,
"schedule": null
},
{
"type": "Agents::TriggerAgent",
"name": "User is student",
"disabled": false,
"description": null,
"guid": "845aa2aa857ffe8832856050abf7d994",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"rules": [
{
"type": "regex",
"value": "student",
"path": "<<explode_users.user.job>>"
}
]
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null
},
{
"type": "Agents::TriggerAgent",
"name": "User is engineer",
"disabled": false,
"description": null,
"guid": "bded45ec772c9f48984d39da6388ff56",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"rules": [
{
"type": "regex",
"value": "engineer",
"path": "<<explode_users.user.job>>"
}
]
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null
},
{
"type": "Agents::HTTPRequestAgent",
"name": "Send a post request",
"disabled": false,
"description": null,
"guid": "dbe0171f0253ebde721ddfb086c323a5",
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"options": {
"url": "https://postman-echo.com/post",
"content_type": "json",
"method": "post",
"payload": {
"name": "<<explode_users.user.name>>",
"age": "<<explode_users.user.age>>",
"country": "<<explode_users.user.country>>",
"job": "<<explode_users.user.job>>"
},
"log_error_on_status": []
},
"reporting": {
"time_saved_value": 0,
"time_saved_unit": "minutes"
},
"monitoring": {
"monitor_all_events": false,
"monitor_failures": false,
"monitor_no_events_emitted": null
},
"template": {
"created_from_template_guid": null,
"created_from_template_version": null
},
"width": null,
"schedule": null
}
],
"diagram_notes": [],
"links": [
{
"source": 0,
"receiver": 7
},
{
"source": 2,
"receiver": 3
},
{
"source": 3,
"receiver": 4
},
{
"source": 4,
"receiver": 6
},
{
"source": 4,
"receiver": 5
},
{
"source": 4,
"receiver": 0
},
{
"source": 6,
"receiver": 1
}
],
"diagram_layout": "{\"9fda86d826c2da6b1001d83de774e6cd\":[105,-195],\"2a1c3710c175566adbac7bdfcb8aa0af\":[345,-120],\"2f1f4538338172e208f653d3a614afb6\":[345,-435],\"e606d66f945ba059655a672497d78170\":[345,-360],\"51ce4f788c04cf81dc7eb7dda25f575b\":[345,-285],\"845aa2aa857ffe8832856050abf7d994\":[570,-195],\"bded45ec772c9f48984d39da6388ff56\":[345,-195],\"dbe0171f0253ebde721ddfb086c323a5\":[105,-120]}",
"send_to_story_enabled": false,
"send_to_story_skill_use_requires_confirmation": true,
"entry_agent_guid": null,
"exit_agent_guids": [],
"exit_agent_guid": null,
"api_entry_action_guids": [],
"api_exit_action_guids": [],
"keep_events_for": 86400,
"reporting_status": true,
"send_to_story_access": null,
"story_library_metadata": {},
"monitor_failures": false,
"send_to_stories": [],
"form": null,
"synchronous_webhooks_enabled": false,
"forms": [],
"pages": [],
"tags": [],
"time_saved_unit": "minutes",
"time_saved_value": 0,
"origin_story_identifier": "cloud:72d8681fa16f17c9cb1b5d0118f96474:8de58314250ff167127d6ae213711de9",
"integration_product": null,
"integration_vendor": null,
"exported_at": "2023-12-15T01:43:37Z",
"integrations": []
}
}
}'
Response
A successful request will return a JSON object describing the newly created story
Field description
| Parameter | Description |
|---|---|
| name | The story name. |
| user_id | ID of story creator. |
| description | A user-defined description of the story. |
| keep_events_for | Defined event retention period in seconds. |
| disabled | Boolean flag indicating whether story is disabled. |
| priority | Boolean flag indicating whether story is high priority story. |
| send_to_story_enabled | Boolean flag indicating if Send to Story is enabled. |
| send_to_story_access_source | STS, STS_AND_WORKBENCH, WORKBENCH or OFF indicating where the send to story can be used. |
| send_to_story_access | Controls who is allowed to send to this story (TEAM,GLOBAL,SPECIFIC_TEAMS). |
| shared_team_slugs | List of teams' slugs that can send to this story when send_to_story_access is SPECIFIC_TEAMS, otherwise empty. |
| send_to_story_skill_use_requires_confirmation | Boolean flag indicating whether workbench should ask for confirmation before running this story. |
| entry_agent_id | The ID of the entry action for this story. |
| exit_agents | An Array of objects describing exit actions for this story. |
| team_id | ID of team to which the story belongs. |
| tags | An array of tags used to classify the story. |
| guid | Unique identifier of the story. |
| slug | An underscored representation of the story name. |
| created_at | ISO 8601 Timestamp representing date and time the story was created. |
| updated_at | ISO 8601 Timestamp representing date and time the story row was last updated. It is best to use edited_at to track any modifications made to the story itself. |
| edited_at | ISO 8601 Timestamp representing date and time the story was last logically updated. |
| mode | The mode of the story. LIVE or TEST |
| id | The story ID. |
| folder_id | ID of folder to which the story belongs. |
| published | Boolean flag indicating whether the story is published. |
| change_control_enabled | Boolean flag indicating if change control is enabled. |
| locked | Boolean flag indicating whether the story is locked to changes. |
| owners | List of user IDs that are listed as owners on the story. |
| monitor_failures | Boolean flag indicating if monitor failures is enabled on the story. |
| recipients | List of monitoring recipients for the story. |
Sample response
{
"name": "Simple story",
"user_id": 167,
"description": "In the simple story we will create a fictional situation where a detection system is configured to send alerts to our Tines tenant",
"keep_events_for": 604800,
"disabled": false,
"priority": false,
"send_to_story_enabled": false,
"send_to_story_access_source": "OFF",
"send_to_story_access": null,
"send_to_story_skill_use_requires_confirmation": true,
"shared_team_slugs": [],
"entry_agent_id": null,
"exit_agents": [],
"team_id": 1,
"tags": ["Tag 1", "Tag 2"],
"guid": "df1e838a18d20696120b41516497b017",
"slug": "simple_story",
"created_at": "2021-05-10T08:56:50Z",
"updated_at": "2021-05-10T08:56:50Z",
"edited_at": "2021-05-10T08:56:50Z",
"mode": "LIVE",
"id": 7981,
"folder_id": 1,
"published": true,
"change_control_enabled": false,
"locked": false,
"owners": [1],
"monitor_failures": false,
"recipients": [
{
"address": "test@example.com"
}
]
}