Introducing: Story Runs

Last updated on

Written by Eoin Hinchy

Tines is pretty simple: you take a security process you want to automate, break it into small steps, and use one of the seven Action types in Tines to perform that step. After an Action performs its function, it passes the result (an event) along to the next Action in the Story which then performs its function, and so on until there are no more steps to perform.

This “atomic” architecture means that with complex stories which process lots of events, troubleshooting can be challenging. It also means that understanding how long it took Tines to process an email, a vulnerability scan, or a Git commit could be *clears throat* time-consuming (no pun intended).

To solve this challenge, we’re proud to announce Story runs.

What’s in a run?

A Story run allows you to trace the exact path an event took through a Story. It contains the Actions and their emitted events allowing you to easily troubleshoot and benchmark your automation stories.

How Tines Story runs work

Simple example

Take the simplified Tines Story below which receives a city name via a webhook Action, gets the weather in that city, and finally emails the result:

We can follow the route taken through the Story by clicking the “Story Runs” tab in the toolbar and selecting a run. In the “Actions & Events” panel we can see the order of Actions and their emitted events in chronological order.

By clicking the Action name in the Story run, we can view and edit that Action’s properties.

Complex example

Now, let’s take a more complex Story containing multiple different branches an event could take.

When we view the run for this Story, we can see that, as expected, Tines displays every Action that emitted an event. In the below example, we see that it’s Tuesday so the “Send weather to Slack” Action emitted an event.

In another run, because the event was received on Saturday, an event was emitted by the email Action:

Story Run performance metrics

Each Story run includes a start time, end time, and duration.

With these metrics, we can easily calculate time and resources saved through Tines. For example, a phishing response Story might take 19 seconds to process a Tines email, whereas to perform the same response manually could take up to 30 minutes.

*Please note we recently updated our terminology. Our "agents" are now known as "Actions," but some visuals might not reflect this.*

security teams

Get started