Community stories
What will you build?
Discover what builders across industries and teams create using Tines. These submissions come from outside of Tines and are shared here for inspiration.
Featured stories
Rickroll users in SlackRedirect unsuspecting victims to Rick Astley's 1987 hit song “Never Gonna Give You Up.”Tools: Slack
Launch DAST scan on web app via CI/CD pipelineThis story is getting triggered from the CI/CD pipeline to launch a DAST scan on a specific web app.
It takes 2 arguments, such as APP Name and ConfigID.
It will launch a scan from Tenable.io and will send a PDF with the results if successful.Tools: Tenable Vulnerability ManagementSpring 2026 winners
You did with Tines?
YDWWT is our semi-annual community competition to find the most creative applications of Tines.
Manage incident lifecycle in Google Chat with Jira Service Management (O.R.B.I.T.)
Orchestrate the full incident lifecycle across Google Chat, Jira Service Management, and JSM Ops — from alert triage and Major Incident war rooms to AI-assisted retrospective scheduling — using four interconnected workflows.
GitLab handover with response teams via a Slackbot
Encourage response teams to handover GitLab cases via a Slack Bot. An example version of the GitLab winning entry into the YDWWT Winter Wonderland Edition competition. This handles a slackbot named "Hando" which encourages Security Incident Response teams to regularly handover cases between regions. This Story was created by GitLab.
Just for fun
Tines isn't just for your best work, it's also for fun!
Engage phishers with time wasting responsesUse AI to waste the time of adversaries running phishing campaigns. Generate unproductive responses to impose costs on the attacker.Tools: OpenAI, Sublime Security
Game: Guess the anime quoteThis workflow leverages multiple parts of the Tines storyboard in a fun, creative way.
In this game, individuals select an anime then guess which character said the quote. Each right answer earns points that are tracked on a live leaderboard.Tools: SlackSubmit your story
We’d love to hear your ideas or see what you’ve created.
Contain or release hosts in CrowdStrike from JiraReceive containment or lift-containment requests from Jira, isolate or release the host in CrowdStrike, and post the outcome back to the ticket, with an AI-reviewed RTR command option for advanced remediation.By Tools: CrowdStrike, Jira Software
Triage Azure Sentinel incidents with AI AgentMonitor new Azure Sentinel incidents, triage them with the Tines Stories AI Agent action using VirusTotal and Log Analytics context, then update the incident, post a comment, and alert Slack.By Tools: Microsoft, Microsoft Azure, Slack
Create Jira issues from Google Threat Intelligence DTM alertsMonitor Google Threat Intelligence DTM alerts on a schedule and automatically create Jira issues for HIGH and MEDIUM severity alerts to accelerate incident response.By Tools: Google, Jira Software
Monitor browser extensions with Island and Socket.dev in Azure SentinelMonitor enterprise browser extensions from Island, check them against Socket.dev threat intelligence, and create Azure Sentinel incidents for any malicious extensions detected.By Tools: Island, Microsoft
Select AI model in Tines by usage costMonitor Tines AI usage costs each month and automatically select the most cost-appropriate model, alerting the team by email when credits run low.By 
Triage threat intel with an AI Agent and log results to Notion and SlackMonitor RSS threat intelligence feeds, use an AI agent to assess relevance against your environment, then log matches to Notion and alert your team in Slack.By Tools: Notion, Slack
Automate offboarding with Okta, Slack, and Datadog observability pipelinesSuspend Okta accounts, revoke sessions, and unenroll devices on employee termination, then tag their logs in Datadog Observability Pipelines for 30 days to flag post-termination activity.By Tools: DataDog, Okta, Slack
Tag and investigate users with Datadog observability pipelinesTag a user's logs in Datadog Observability Pipelines when an analyst submits an investigation, then automatically remove the tag when the case is closed.By Tools: DataDog
Suppress alert storms with ServiceNow CMDB and Datadog Observability PipelinesInvestigate Datadog brute-force alerts against the ServiceNow CMDB to automatically suppress known scanners or escalate unrecognized IPs to Slack for analyst review.By Tools: DataDog, ServiceNow, Slack