# How do I integrate Tines with threat intelligence platforms like VirusTotal or Shodan? **URL:** \ **Category:** Tines Stories: Ask + Answer\ **Created:** [June 30, 2026, 2:53pm UTC](https://community.tines.com/t/how-do-i-integrate-tines-with-threat-intelligence-platforms-like-virustotal-or-shodan/67 "2026-06-30T14:53:04Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sapling](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/sapling/32/36_2.png) [@sapling](https://community.tines.com/u/sapling)\ **Post date:** [June 30, 2026, 2:53pm UTC](https://community.tines.com/t/how-do-i-integrate-tines-with-threat-intelligence-platforms-like-virustotal-or-shodan/67/1 "2026-06-30T14:53:04Z")
Enriching indicators is a big part of my triage process and right now it’s all manual. I want to automate lookups against VirusTotal, Shodan, and a few other threat intel sources. Are these supported in Tines, and how do people typically structure enrichment workflows? Any tips on making this efficient at scale would be great too. ---
**Author:** ![Angie](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/angie/32/44_2.png) [@Angie](https://community.tines.com/u/Angie)\ **Post date:** [July 10, 2026, 9:42pm UTC](https://community.tines.com/t/how-do-i-integrate-tines-with-threat-intelligence-platforms-like-virustotal-or-shodan/67/2 "2026-07-10T21:42:03Z")
Oh, this is one of my favorite things to automate, because manual indicator enrichment is _exactly_ the kind of repetitive tab-switching that eats a triage analyst’s day. 🧑‍💻 VirusTotal, Shodan, and most other threat intel platforms are well-supported in Tines! Both are available in the [Tines Story Library](https://www.tines.com/library) with pre-built lookup actions you can drop straight into a story, so you’re rarely starting from a blank canvas. Authentication is nice and simple too, since both use API key auth, which you store as Tines credentials and reference securely at runtime. For structuring the workflow itself, a clean, scalable pattern looks like this: 1. **Fan out your indicators.** If you’ve got a list of IPs, hashes, or domains, use the **Explode mode of the Event Transform action** to split them into separate events so each one is enriched independently. 2. **Look up each source in parallel.** Run VirusTotal, Shodan, and any others into separate story forks so you’re not waiting on them one at a time. 3. **Normalize early.** Reshape each platform’s response into a consistent schema (with another Event Transform action) right after the lookup. That way, your downstream logic (severity scoring, routing) doesn’t have to care about each vendor’s response format. 4. **Bring it back together and act.** Consolidate the results, score them, and route accordingly. **On rate limits** (especially on free or lower-tier API plans): you’ve got a couple of options that are better than a plain delay: - The **Throttle mode** of the Event Transform action emits events at a steady, capped rate, so it’s purpose-built for respecting API limits across everything flowing through it. - You can also set the HTTP Request action to automatically **retry on a `429` (“Too Many Requests”)** with exponential backoff by adding `429` to its `retry_on_status`. Extra resources to help! ☀ - The [Tines Docs](https://www.tines.com/docs) cover HTTP actions and credentials, and there’s a great [API rate limiting walkthrough](https://explained.tines.com/en/articles/9824524-example-approach-api-rate-limiting) on Tines Explained that shows the Explode/Delay/Throttle approaches in practice. - [Tines University](https://www.tines.com/university) has exercises on building enrichment workflows. - The [Blog](https://www.tines.com/blog) has real-world threat intel automation examples worth a look. ---
**Author:** ![system](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/system/32/232_2.png) [@system](https://community.tines.com/u/system)\ **Post date:** [July 13, 2026, 9:02am UTC](https://community.tines.com/t/how-do-i-integrate-tines-with-threat-intelligence-platforms-like-virustotal-or-shodan/67/3 "2026-07-13T09:02:17Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.