I’ve heard Tines has built-in AI capabilities and I’m curious how people are actually using them in security workflows. Alert summarization seems like an obvious win. Has anyone used the AI features to summarise alerts or investigation context for analysts? What does that look like in practice, and are there things to be careful about?
Yes, this is a really common use case and honestly one of the better entry points into using AI in a security workflow, precisely because summarization is low-risk. Worst case scenario?The summary is mediocre and an analyst ignores it; it’s not making a blocking decision on its own.
In practice, the pattern usually looks like this: your enrichment steps run as normal (threat intel lookups, asset context, user context, whatever you’d already be pulling), and then right before the alert lands in front of an analyst, an AI action takes all that raw enriched data and condenses it into a few sentences of plain-language context. Instead of an analyst scrolling through five API responses to figure out “is this bad,” they get something like “this IP has a history of scanning activity per GreyNoise, the user has no prior anomalous logins, and this rule has a 90% false positive rate over the last 30 days” as the first thing they see.
That’s the actual time savings, not the automation itself but the cognitive load reduction.
There’s a library example that leans further into this, using two AI agents where one reads the alert and locates the relevant SOP in Confluence, and a second reasons through the remediation steps, with everything documented in the case history and a Slack notification going to the on-call team. It’s a good reference even if you only want the summarization half rather than the full agentic remediation piece. This write-up on The Hacker News is a great reference to use when following along.
There’s also a more focused library story for correlating and grouping alerts by risk using AI, which is adjacent to summarization since a lot of the value is in reducing twenty related alerts into one coherent risk picture rather than twenty separate things to read.
On the “be careful about” side, a few things genuinely matter here:
- Always keep the raw data available alongside the summary, never replace it. Analysts need to be able to verify the summary against source data, especially early on before trust is established, and honestly even after.
- Watch for confidence laundering, where a vague or uncertain enrichment result gets summarized into a confident-sounding sentence that overstates what’s actually known. Worth reviewing prompts specifically for this, and maybe explicitly asking the model to flag uncertainty rather than smoothing over it.
- Be deliberate about what data goes into the prompt. Alert payloads sometimes contain sensitive fields (PII, credentials, internal hostnames) you may not want flowing through a third-party LLM depending on your data handling policies, so this is worth checking against whatever compliance obligations you’re already working under.
- Treat the summary as a starting point for triage, not a verdict. It’s easy for “summarize this alert” to quietly drift into “decide if this alert matters,” which is a bigger leap in risk than most teams intend to make on day one.
Let me know if you have any more questions!