Teams regularly need to perform a task or a set of tasks in multiple different automation stories. For example, a threat intelligence story and a phishing response story may use the same procedure to analyze a URL; similarly a user de-provision story and a vulnerability management story may require you to find and then relate tickets in Jira based on a search term. Tines can now help you solve this problem once and for all!
Continuing our deep-dive into new features included in the Tines Autumn 2019 release, we’re proud to detail information about our latest feature ‘Send to Story‘.
Rather than creating the same set of actions in multiple stories (thus violating the DRY-principle), the Send to Story action allows users create “sub-stories” to which events can be sent from other stories. When the sub-story receives an event, it will perform its function and when finished, emit an event from the sending action.
Sub-stories work the exact same as normal Tines stories. The only difference being that a sub-story has an Entry action and an Exit action. The entry action must be a webhook type action. The exit action must be a message-only mode event transformation action.
Enabling a story for Send to Story (creating a sub-story)
From a storyboard, when no actions are selected, in the properties panel there is a checkbox to enable a story for Send to Story. When this checkbox is clicked, you’ll be asked to specify entry and exit actions. A sub-story can only have one entry and one exit action.
Enable sub-story from storyboard
Configure send to story
When a Send to Story action sends an event to a sub-story, the entry action will emit an event to its receiver actions. Entry actions must be of type Webhook.
The Exit action is the last action in a sub-story and must be a message-only mode event transformation action. The content specified in the Exit action will be emitted by the action that originally sent the event to the sub-story.
Sending to a Sub-Story
When you need to send data to a sub-story, you should use a Send to Story Action with the story widget. For example say we have a sub-story called Substory we would send events to this sub-story with a Send to Story Action:
You can create a new Send to Story action by dragging an Empty action from the action library panel.
The entry action in Sub-story will then emit an event similar to the below:
When this event has run down the story, the Exit action will emit an event, and the calling Send to Story agent will also emit an event that matches the exit action’s configuration.
For example, let’s say the HTTP Request action above was named “Analyse URL” and we have the following exit action defined in Substory:
When the sub-story is complete Analyze URL will emit an event similar to the below:
To illustrate this further, you can download a sample story, ‘analyze URL in urlscan’ here.
Note, to import and run this story you’ll need to create a credential, urlscan_io, using an API Key from urlscan.io.)
This story is designed to submit URLs to urlscan for analysis. It will then wait for 30 seconds while urlscan processes the results, and, when complete, return the verdict.
This analyze URL in urlscan process now be can now be called from any other Tines story to analyze urls using a Send to Story action. You can also run the action from within the Sub-Story itself and hardcode a URL to analyze. This way you can just click “Run” and shortly after Tines will return with the results of the URL Analysis.
Send to Story Ideas
Other repeatable processes our customers have automated include:
Analyze an IP Address, Domain or Email Address
Search a SIEM for visits to a Domain
Lock a User’s Account
Update a JIRA Ticket
Analyze a Suspicious File in a Sandbox
Find and Relate Tickets in a Case Management System
Find and Send a User an Instant Message
*Please note we recently updated our terminology. Our "agents" are now known as "actions," but some visuals might not reflect this.*