Cases

Automation for the threats you know, cases for the ones you don’t

Learn more ^↗

Description

Case metrics
Runbook

Detection records

Initial detection and triage

Incident notification and coordination

Containment and isolation

Response and mitigation

Eradication and recovery

Followup records

Post-incident activities

Closure note

High

Critical alert, host: MARTIN-PC

Alert Incident

Case metrics

Type	Case time	SLA time	Met SLA?
TTD	To be updated with TTD time	60 min	To be updated with TTD SLA result
TTR	To be updated with TTR time	4 hr	To be updated with TTR SLA result

CrowdStrike detection received: View details below for further detection, behavior, and IP enrichment information.

Runbook

Go to Runbook

Initial detection and triage

CrowdStrike Falcon alerts about a potential security incident

Confirm the severity and priority level

Gather basic information about the alert, including affected hosts, observed behaviors, and timestamps

Verify if the alert aligns with known threat intelligence or attack patterns

Incident notification and coordination

Notify stakeholders, including the incident response team, SOC, and relevant IT personnel

Establish clear lines of communication and assign roles to team members

Create and incident ticket or record in your incident management system

Containment and isolation

Identify affected hosts and isolate them from the network to prevent further compromise

Engage CrowdStrike’s containment capabilities, if available, to isolate the affected hosts

Consider applying network-based controls to block associated suspicious traffic

Leverage CrowdStrike’s threat intel and community forums to gather additional info

Response and mitigation

Based on the findings, develop a mitigation plan to address the incident effectively

Apply necessary patches, updates or configurations to address any vulnerabilities found

Identify compromised user accounts, credentials, or access rights, and revoke or reset them as appropriate

Implement necessary changes to security policies, configurations, or access controls to prevent future similar incidents.

Investigate, remediate, and report on an incident in a collaborative workspace with Tines Stories’ powerful, intuitive case management.

Records

Capture data across workflows to report on this in a consistent, structured format.

Dashboards

Monitor and report on workflow performance with cases and records in one location.

Better automations, fewer cases, faster incident response

Bring humans into the loop when it matters for your business while workflows run to capture the rest. Cases make it easy to work on incident response and create an audit trail of the resolution.

Reduce friction without compromising on your technology

Automation often involves other teams – DevOps, IT, HROps – who work in other systems. Effectively collaborate across those systems and teams using cases.

Examples

Summarize event data and pass to a case
Format a case template using Markdown
Summarize what happened on a case and pass it to a page
Format a timeline of events into a visualization then add it to a case
Map record data

Use AI to create cases and act on CrowdStrike alertsGet CrowdStrike alerts and create a Tines case using AI to build the ticket. Use AI to automatically initiate required remediation steps.Tools: CrowdStrike, Okta, PagerDuty, Zscaler

Normalize alerts with Tines AI and create CasesUse Tines AI to normalize alerts from various sources. If the analyzed threat level is determined to be high, a Case will also be created in Tines to track.

Learn more about AI in Tines

Build, run, and monitor your most important workflows with secure, private AI in Tines.

Why Tines cases?

Fast

This is automation-first case management: create a case from within your existing workflow. From creation to search to correlating information – the experience feels instantaneous.

Flexible

Cases don’t presume a way of working, it responds to yours. Start from a template, fine tune to your own preferences; or both. Cases connects to any workflow, record, page, or API.

Powerful

Define advanced, nuanced data tracking across stories and cases. Aggregate into a dashboard to track SLAs, open cases, MTTR and more.

Collaborative

Mitigate risks with teams from a single location with intuitive components. Cases provide real-time visibility into data that can be analyzed, aggregated and reported to share with key stakeholders.

Start building today

Talk to one of our experts or explore our docs, to learn how your business can leverage Tines cases.

Talk to an expert

Examples

See examples in our workflow library

Not sure where to start? Explore examples of cases in our library.

View examples

Docs

Learn cases through the documentation

Get a breakdown of cases and its features in the product docs.

Go to docs

Learn

Tines
University

Learn how to build in Tines; from the basics to advanced.

Learn more

Get certified

Certification
programs

Become immersed in the Tines product with hands-on labs.

Enroll now

Explore Tines Stories

Storyboard

Flexible, intuitive workflow builder

Details →

Workbench

Universal, Tines-powered AI copilot

Details →

Cases

Intuitive case and incident management

Details →

Built by you,
powered by Tines

Book a demo Sign up free

Cases

Records

Dashboards

Better automations, fewer cases, faster incident response

Reduce friction without compromising on your technology