Enriching indicators manually across multiple tools is slow and error-prone. I’d like to automate the whole loop: take an IOC, look it up across sources, make a decision, and take action. I’m curious how others have structured this in Tines and what the typical flow looks like from indicator to response.
IOC enrichment is a great fit for Tines and a workflow many teams build early, precisely because it takes that slow, error-prone manual pivoting across tools and turns it into one consistent, repeatable loop.
The typical flow, from indicator to response
- Trigger. Something kicks the story off with one or more indicators: a SIEM alert, a Slack command, a webhook from your ticketing system, or a forwarded email.
- Fan out (if you have a list). If multiple IOCs come in as an array, use the Explode mode of the Event Transform action to split them into separate events so each indicator is enriched independently, in parallel.
- Enrich in parallel. For each indicator, query your sources at the same time in separate branches: VirusTotal, Shodan, AbuseIPDB, GreyNoise, your internal threat intel platform, whatever you rely on. Each is just an HTTP Request action (or a prebuilt one from the Library).
- Normalize. Enrichment sources all return different shapes, so use the Event Transform action to reshape the results into one consistent structure. This is the step that makes your downstream logic clean and reliable. (If you exploded a list earlier, the Implode mode can reassemble the individual results back into a single event when you want a consolidated view.)
- Decide. Branch on the normalized verdict: low confidence gets logged, medium confidence creates a ticket for review, high confidence triggers a containment action.
- Respond. On the high-confidence path, take the action: block the IP at the firewall, isolate the host in your EDR, disable an account in your IdP, and so on. This is also a natural spot to drop in a human-in-the-loop checkpoint (a Page or Slack approval) before anything irreversible fires.
A tip worth building in early: deduplicate before you enrich. If the same indicator shows up repeatedly, you save API calls and avoid re-alerting on something you’ve already actioned.
Here are some resources to help you get started!
- The Tines Story Library has enrichment templates ready to adapt. Two close to your use case: Analyze an IP in many services at once and Receive enriched IP information via Slack. The Threat intelligence collection is worth a browse too.
- The Docs cover the Event Transform action (including Explode and Implode modes) and data transformation in detail.
- Tines University has hands-on exercises for building enrichment pipelines end-to-end.