Stories are a collection of interconnected actions working towards a singular mission. They can be viewed as analogous to use-cases or playbooks. For example, you might have a Phishing story, an Infected endpoint story or a DDoS story. To support sharing, Stories can be imported and exported.
Adding Actions to Stories
Actions can be added to a story by dragging an empty action or a template onto the storyboard. Actions can be in only one story at a time and they can only receive from and emit to actions in the same story.
Publish/ Unpublish Stories
When you start creating a new story, it is unpublished by default. An unpublished story is similar to a draft. It will be restricted in that it will only run when triggered manually. Unpublished stories do not count towards your stories quota.
When your story is ready to go, it's time to publish! A published story will run unrestricted, so webhook actions and schedules will run autonomously. When publishing a story, a checkbox can be checked to emit all held events upon publishing. When a story is unpublished with held events, a button appears in the Publish dropdown allowing you to emit all held events. Published stories do count towards your stories quota.
When Tines tenants are created they contain 3 stories:
- The Simple story: A short story that demonstrates how actions and events interact to automate workflows.
- Simple Story - VPN Notification: This story demonstrates how automated threat detection and response can be performed on corporate VPN connections.
- Analyze URL in URLScan: This story demonstrates how Tines actions can be used to analyze suspicious URLs.