A surprisingly large part of our security workflow still runs through email, things like phishing reports, vendor alerts, and approval chains. I’m wondering how well Tines handles email as both an input and an output. Can it receive and parse incoming emails, and is sending formatted emails straightforward? Curious what’s possible here.
Tines handles email in both directions, and it’s a genuinely common pattern, so you’re in good company here. 
Incoming email
The Receive Email action is your entry point, and it works in two modes:
- Email mode (the easy one): Tines generates a unique email address on the action. Anything sent to that address triggers the workflow, so analysts can just forward suspicious emails straight in. No server setup required.
- IMAP mode: the action watches an existing IMAP mailbox and fires when new mail arrives, handy if you want to monitor a shared inbox like
phishing@yourcompany.com.
Either way, the email content, subject, sender, and any attachments all come through as structured data in the story, ready for parsing and routing. Attachments arrive Base64-encoded, so you can pass them straight to something like VirusTotal for analysis. That’s exactly what makes phishing triage so straightforward to build.
Outgoing email
Tines has a built-in Send Email action that supports HTML formatting (there’s an HTML editor built in), attachments, and dynamic content pulled from your story data. You can set the reply-to address, sender name, CC, subject, and body. By default it sends from mail@tines.io, but there’s a custom sender email address feature (powered by Amazon SES) if you need mail to come from your own domain. And if you want tighter control, you can always send via an external provider like SendGrid or Microsoft 365 through their APIs using an HTTP Request action.
Getting started
Email-based phishing workflows are one of the most popular use cases in Tines, so there’s a lot to borrow from:
- The Tines Story Library has phishing triage templates worth exploring.
- The Tines Docs cover both the Receive Email action and the Send Email action in detail, including how attachments and files flow through (Working with files).
- Tines University has guided exercises that walk through email-based workflows.