How do I integrate Tines with threat intelligence platforms like VirusTotal or Shodan?

Tines Stories: Ask + Answer
1

Enriching indicators is a big part of my triage process and right now it’s all manual. I want to automate lookups against VirusTotal, Shodan, and a few other threat intel sources. Are these supported in Tines, and how do people typically structure enrichment workflows? Any tips on making this efficient at scale would be great too.

2

Oh, this is one of my favorite things to automate, because manual indicator enrichment is exactly the kind of repetitive tab-switching that eats a triage analyst’s day. :technologist: VirusTotal, Shodan, and most other threat intel platforms are well-supported in Tines!

Both are available in the Tines Story Library with pre-built lookup actions you can drop straight into a story, so you’re rarely starting from a blank canvas. Authentication is nice and simple too, since both use API key auth, which you store as Tines credentials and reference securely at runtime.

For structuring the workflow itself, a clean, scalable pattern looks like this:

  1. Fan out your indicators. If you’ve got a list of IPs, hashes, or domains, use the Explode mode of the Event Transform action to split them into separate events so each one is enriched independently.
  2. Look up each source in parallel. Run VirusTotal, Shodan, and any others into separate story forks so you’re not waiting on them one at a time.
  3. Normalize early. Reshape each platform’s response into a consistent schema (with another Event Transform action) right after the lookup. That way, your downstream logic (severity scoring, routing) doesn’t have to care about each vendor’s response format.
  4. Bring it back together and act. Consolidate the results, score them, and route accordingly.

On rate limits (especially on free or lower-tier API plans): you’ve got a couple of options that are better than a plain delay:

  • The Throttle mode of the Event Transform action emits events at a steady, capped rate, so it’s purpose-built for respecting API limits across everything flowing through it.
  • You can also set the HTTP Request action to automatically retry on a 429 (“Too Many Requests”) with exponential backoff by adding 429 to its retry_on_status.

Extra resources to help! :sun:

  • The Tines Docs cover HTTP actions and credentials, and there’s a great API rate limiting walkthrough on Tines Explained that shows the Explode/Delay/Throttle approaches in practice.
  • Tines University has exercises on building enrichment workflows.
  • The Blog has real-world threat intel automation examples worth a look.