Find your fit
Who it is for
It suits security teams that spend time moving alert details between tools and want a repeatable triage and response process. The value depends on the quality of the source alerts, tool APIs and workflow design; Tines is an orchestrator around those systems rather than a standalone threat sensor.
IT and other operational teams can use the same platform for nonsecurity workflows. Buyers should decide whether they need the Stories workflow tools, Cases for incident work or the broader Tines 3B environment, then confirm the edition and entitlements in the quote.
The work it supports
Core capabilities
Storyboard lets a builder connect actions in a visual workflow. Webhooks and incoming email can start a flow, while HTTP requests exchange data with another system. A small pilot should trace one harmless incoming alert through each connected step and record any permissions it needs.
Event Transform can restructure incoming data, a condition can branch based on that data, and a story can be nested for reuse. This is useful when several alert sources need the same normalization or escalation process; test malformed input and retry behavior before going live.
Tines describes automatic alert prioritization and enrichment for security operations. The analyst still needs to know which source supplied each detail and whether a lookup failed. Set a human approval step for actions such as changing accounts or isolating devices until response authority is clear.
Workflow designers can choose deterministic steps, AI-based activity or human-in-the-loop decisions. Control how much autonomy a particular process has, especially when a connector can write or delete data. Review credentials, roles, change control and retry behavior with the people who own the connected systems.
Cases provides a collaborative place to investigate, remediate and report on an incident, and can retain an audit trail of the resolution. Check whether the case structure, assignee handoff and retained evidence match the incident process your team already follows.
Workbench is a Stories-powered AI chat interface that can use connected actions and data. Treat its ability to take action as a permission design question: test what it can read, what it can change, how a person approves a sensitive step and where actions are logged.
Tines says Stories can connect to tools with APIs. Tines 3B also describes spaces with assigned connectors and permissions. Inventory the APIs, scopes, secrets, rate limits and owners of each tool before estimating how much of a response workflow can really be automated.
Understand the offer
Pricing and getting started
The current general pricing page has a free edition for experimentation, listing three live workflows, and asks buyers to get pricing for paid editions. Its paid-edition summary lists unlimited workflows, but a buyer should still check events, environments, support, AI allowance and any other usage limits in the proposal.
Tines Stories documentation names Community, Business and Enterprise editions with different usage allocations for stories, teams, users and daily events, plus possible add-ons. It says Business and Enterprise can be self-hosted. Confirm which edition is being quoted, especially if the buyer needs Cases or AI features.
Tines calls the free 3B Explore plan equivalent to Stories Community, while describing a platform license model for 3B. The two naming schemes should be reconciled in writing before using published limits to budget an existing Stories tenant or a new 3B deployment.
Look a little closer
Before you choose
Start with a low-risk workflow: bring in a sample alert, enrich it from one read-only source, route it to a human, then create a test case. Measure missing data, duplicate events, failed API calls and whether the audit trail lets another analyst understand the decision.
Before granting write access to an endpoint, identity or ticketing tool, agree who may edit and approve a story, which credentials it runs with and how to reverse a wrong action. Review AI access and data handling separately if Workbench or 3B agents are in scope.
Have sales map the proposed use to the current Tines 3B or Stories edition. Check live workflow and event limits, add-ons, AI allowance, hosting, support and migration terms against the actual contract rather than assuming similarly named free plans have identical limits.
8 distinct sources behind this profile. Research observed Oct 18, 2026. Features and offers can change.
View sources and research →
