What is a Story in Tines?

What Is a Story in Tines

In Tines, a Story is the name for a single automation workflow. It is the Tines equivalent of a Zap in Zapier, a Scenario in Make, or a Playbook in traditional SOAR vendors such as Splunk SOAR. A Story is a directed graph of Actions connected by event flow: when an Action produces an event, downstream Actions receive it and process it according to their configuration.

Stories Are Composed of Actions

Every Story is built from six core Action types. As of April 2026, Tines deliberately keeps the Action catalog small so that analysts master the full toolkit:

• HTTP Request — Calls any REST API (GET, POST, PUT, PATCH, DELETE). This is the most-used Action; most SaaS integrations are HTTP Requests against the vendor API.
• Send Email — Sends outbound email via Tines' SMTP relay or a configured mail server. Used for notifications, approvals, and analyst updates.
• IMAP — Polls a mailbox and emits events for new messages. Common in phishing triage workflows where users forward suspicious emails to a shared inbox.
• Trigger — Branches event flow based on conditions. A Trigger evaluates rules (equality, regex, JSONPath) and only emits events that match, filtering the Story's downstream logic.
• Event Transform — Reshapes event data: explode arrays into individual events, aggregate events over time, deduplicate, or map fields.
• Webhook — Receives inbound HTTP requests from external systems, turning Tines into a webhook receiver. This is how external alerts (SIEM, ticketing, monitoring) kick off a Story.

Event Flow and Story Execution

Actions in a Story are connected by links. When an Action emits an event, it is queued and delivered to each downstream Action. Events are JSON objects and can reference fields from any prior event in the Story via a Jinja-style template syntax ({{ .received_event.body.subject }}). Because Stories are asynchronous event graphs rather than sequential scripts, multiple events can flow through the same Story concurrently.

Stories vs Resources, Credentials, and Tenants

Stories live inside a Team, which groups related work. Teams share Credentials (stored secrets for API authentication) and Resources (shared reference data such as lookup tables or configuration constants). A Tenant is the top-level Tines account; large organizations can run multiple Tenants for separation between environments or business units.

Typical Story Size

Production Stories commonly contain 10-40 Actions. Complex SOAR playbooks with multiple enrichment steps, conditional branching, and approval loops can reach 100+ Actions, but Tines recommends splitting very large Stories into smaller Stories connected by Webhooks for maintainability.

Exporting and Versioning Stories

Stories export to JSON and can be version-controlled in Git. Tines provides a Story Library where teams share reusable patterns, and the platform includes a change history view that shows recent edits to each Action within a Story.