Most of my Tines usage so far has been reactive, responding to alerts rather than proactively looking for threats. I’m curious whether Tines is a good fit for threat hunting too. Things like running scheduled queries against a SIEM or EDR, chaining lookups, and surfacing results for analyst review. Has anyone built hunting workflows in Tines?
Absolutely, Tines can be a strong fit for threat hunting, particularly as the orchestration layer around your SIEM, EDR, and enrichment tools rather than as the query engine itself.
A typical hunting workflow might:
-
Run on a defined schedule.
-
Query a SIEM or EDR through an API using an HTTP Request action.
-
Normalize, filter, deduplicate, and loop through the returned results.
-
Enrich potential matches using threat intelligence, identity, asset, or vulnerability data.
-
Store findings in Records and create a Case or analyst notification when something warrants review.
For reliability, would recommend using bounded query windows, retaining the last successful query time, accounting for pagination and API rate limits, and requiring analyst approval (or a human-in-the-loop touchpoint) before any containment action.
The Tines Story Library also has a useful example for threat hunting with SentinelOne Deep Visibility that can be imported and adapted.
Starting with one narrow, well-defined hunting hypothesis is usually the best approach. Once the query and analyst-review process are producing useful results, the enrichment and response portions can be expanded gradually.