Tines

Purpose

Connect Tines with AirMDR to securely execute supported automation and orchestration operations using the Tines REST API.

Tines does not generate a separate Tenant Key. In AirMDR, the required value is labelled Tenant Domain. Enter the base URL of your Tines tenant, such as https://company.tines.com.

Supported Versions

Component	Supported configuration
Tines deployment	Tines cloud and API-accessible self-hosted deployments
API	Tines REST API
Authentication	API key
API authentication headers	`Authorization: Bearer <API_KEY>` or `X-User-Token: <API_KEY>`
Network protocol	HTTPS
AirMDR connection fields	Tenant Domain and API Key

For a self-hosted Tines deployment, confirm that its installed version supports the API endpoints required by the AirMDR skills.

Tines API endpoints can use /api/v1/ or /api/v2/, depending on the resource being accessed. AirMDR automatically uses the endpoint required by each supported integration skill.

Authentication

The integration requires the following values:

AirMDR field	What to enter	Where to get it
Tenant Domain	Base URL of the Tines tenant, such as `https://company.tines.com`	Copy the origin from the browser address bar after signing in to the required tenant
API Key	API key generated for the AirMDR integration	Tines Settings → Access & security → API keys

Tenant Domain format

Enter the complete base URL: https://company.tines.comFor a self-hosted environment: https://tines.example.comDo not enter: https://login.tines.com, or https://company.tines.com/api/v1/ or company.tines.com/team/123/stories

Avoid API paths, team paths, story paths, query parameters, and unnecessary trailing characters.

Pre-requisites

Users must have Administrator access to the Tines UI with sufficient privileges to create an API key or approval from a Tines tenant owner.

Permission to create and access the Tines API keys settings.

A tenant owner can restrict API-key creation. When this restriction is enabled, only tenant owners and users assigned the API_KEY_CREATE tenant permission can create API keys.

Setup Steps

Identify the Tines tenant domain

Sign in to the Tines tenant that you want to connect with AirMDR.
Confirm that you are in the correct tenant.
In the browser address bar, copy only the base URL. Example: https://company.tines.com
Save this value securely. You will enter it in the AirMDR Tenant Domain field.
If your organisation has multiple Tines tenants, verify that you copy the domain from the tenant containing the teams, stories, cases, or other resources required by AirMDR.

Generate an API key in Tines

Sign in to your Tines tenant.
Open Settings from the Tines navigation menu or user menu.
Under Access & security, select API keys.
Select New API key or Create API key.

Select the appropriate API-key type:

Select Team API key when AirMDR only needs access to a specific team.
Select Service API key when AirMDR requires selected tenant-level permissions.
Use a Personal API key only for temporary testing.

Do not select Tenant owner API key unless full tenant access is necessary.

To further understand the Tines API key types refer to the below content

API key types

Tines supports four API-key types:

API-key type	Access model	Recommendation
Personal API key	Inherits the access of the user who created it	Avoid for production integrations because it is tied to an individual user
Service API key	Uses a separate service account and can be assigned specific tenant permissions	Recommended when AirMDR requires selected tenant-level permissions
Team API key	Uses a service account with role-based access to a specific Tines team	Recommended when AirMDR only needs access to one team
Tenant owner API key	Provides full owner access across the tenant	Avoid unless the supported AirMDR operations explicitly require owner-level access

Tines records operations performed through service, team, and tenant-owner keys against their associated service-account users. An underprivileged key may return 404 Not Found when it attempts to access a protected resource.

Prefer a Team API key or restricted Service API key and grant only the access required by the enabled AirMDR skills.

Enter a descriptive name, for example: AirMDR Integration
If prompted, enter a description: API key used by AirMDR to access approved Tines resources.
For a Team API key, select the Tines team and the minimum role required by the enabled AirMDR skills.
For a Service API key, select only the required tenant permissions.
Select Create.
Copy the generated API key and store it in an approved secrets-management system.
Store and share the token securely with AirMDR.
Tines displays the token only once. Make sure to record the token, Tines will never again provide that token to you, this is your one and only chance to record it.

If it is lost, generate a new token.

Tines Credential Reference Table

AirMDR Field	What to Enter	Where to Get It in the Tines UI	Example
Tenant Domain	Base URL of the Tines tenant	Sign in to the required Tines tenant and copy the base URL from the browser address bar. Do not include API, team, or story paths.	`https://company.tines.com`
API Key	API key generated for the AirMDR integration	In Tines, navigate to Settings → Access & security → API keys → New API key. Configure the appropriate key type and permissions, create the key, and copy its value.	`<TINES_API_KEY>`

Tines does not generate a separate Tenant Key. Enter the Tines tenant’s base URL in the AirMDR Tenant Domain field.

Validate Connectivity

Use the following request to confirm that the tenant domain and API key can access the Tines Teams API:

Sample Request

curl --proto '=https' --tlsv1.2 \
  -X GET "https://<tenant-domain>/api/v1/teams" \
  -H "content-type: application/json" \
  -H "Authorization: Bearer <TINES_API_KEY>"

Sample Response

Sample Successful Response:

A successful request returns the teams accessible to the API key. The /api/v1/teams endpoint and bearer-token format are documented by Tines.

{“teams”: [{“id”: 1,“name”: “Security Team”,“groups”: [{“id”: 3,“name”: “Tier 1”}]},{“id”: 2,“name”: “Engineering Team”,“groups”: []}],“meta”: {“current_page”: “https://<tenant-domain>/api/v1/teams?per_page=20&page=1”,“previous_page”: null,“next_page”: null,“next_page_number”: null,“per_page”: 20,“pages”: 1,“count”: 2}}

A successful request returns the teams accessible to the API key. The /api/v1/teams endpoint and bearer-token format are documented by Tines.

Do not run the command on shared systems or save the API key in shell history. Use environment variables or an approved secret manager where possible.

Configure Tines in AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select ADMIN → Integrations.
Use the search option, enter the keyword “Tines”, select the Connections tab, and click + New Connection button.

Use the following values in the AirMDR integration configuration screen:

AirMDR Field	Description	Example
Instance	Unique name for the connection	`Tines-Production`
Organization	<Your company name>	`AirMDR Organization`
Description	Purpose of the connection	`Tines production integration`
Tenant Domain	Base URL copied from Tines	`https://company.tines.com`
API Key	API key generated in Tines	`<TINES_API_KEY>`

Expand Advanced Configuration if required. (Optional)

In Remote Agent, select an AirMDR Remote Agent only when the Tines tenant is self-hosted, privately accessible, or must be reached through an approved private network route.
In Expiry, select the date on which AirMDR should treat the stored connection credentials as expired, according to your organisation’s credential-rotation policy.
The AirMDR Expiry setting is a connection-management control. It does not automatically configure or rotate the API key in Tines.

Click Save.

Skills provided by this Integration

Artifact Management

Skill ID	Purpose
Get Tines Artifact	Retrieves large text-based data or content stored as an artifact for a specified Tines record.

Story Management

Skill ID	Purpose
List Tines Stories	Retrieves stories from the Tines instance, with optional filtering by team or folder.
Get Tines Story	Retrieves the details and configuration of a specified Tines story using its story ID.
Create Tines Story	Creates a story within a specified Tines team, with optional folder placement and tag configuration.
Update Tines Story	Updates an existing story’s properties, including its name, enabled or disabled status, tags, and event-retention settings.

Case Management

Skill ID	Purpose
List Tines Cases	Retrieves cases available in the connected Tines instance.
Get Tines Case	Retrieves the complete details of a specified Tines case using its case ID.
Create Tines Case	Creates a case within a specified Tines team using the supplied case information.
Update Tines Case	Updates the information or configuration of an existing case in the connected Tines instance.

Resource Management

Skill ID	Purpose
List Tines Resources	Retrieves resources from the Tines instance, with optional filtering by team or folder.
Get Tines Resource	Retrieves the details and stored value of a specified Tines resource using its resource ID.
Update Tines Resource	Updates a live resource or its test version, including its name, stored value, and access-control settings.

Record Management

Skill ID	Purpose
Create Tines Record	Creates a record within a specified Tines record type (widget) and can optionally associate the record with one or more cases.

Event Management

Skill ID	Purpose
List Tines Events	Retrieves recent events from the Tines instance, with optional filtering by story or team.
Get Tines Event	Retrieves the payload and associated metadata of a specified Tines event using its event ID.

Workflow Execution

Skill ID	Purpose
Send Tines Webhook	Sends a webhook request to a specified Tines webhook endpoint to initiate or continue a Tines workflow.

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → Tines Integration page.
Select the Skills tab and click on the required listed skills.

Additional Information

🧰 Error Handling

Error or symptom	Likely cause	Resolution
Invalid tenant domain	Login URL, API path, team path, or incorrect tenant was entered	Enter only the base tenant URL, such as `https://company.tines.com`
401 Unauthorized	API key is missing, invalid, deleted, or incorrectly copied	Generate or copy a valid key and update the AirMDR connection
404 Not Found	Resource does not exist, or the key lacks permission to access it	Verify the resource and assign the required team role or tenant permission
403 Forbidden	Access is blocked by tenant security or access-control policy	Review tenant permissions, IP restrictions, and organisational security controls
429 Too Many Requests	Tines API rate limit was reached	Reduce request frequency and retry with exponential backoff
Connection timeout	DNS, firewall, proxy, or Remote Agent connectivity issue	Allow outbound TCP 443 and verify access to the configured tenant domain
TLS or certificate error	Invalid, expired, or untrusted certificate, commonly in self-hosted deployments	Install a trusted certificate and verify the certificate chain
Some skills work, but others fail	The API key has partial access	Map each failing skill to the required Tines resource and grant only the missing permissions
Connection stops after the AirMDR expiry date	The AirMDR connection has reached its configured expiry	Rotate or validate the key and update the AirMDR expiry setting
Wrong tenant data returned	Domain belongs to a different Tines tenant	Delete or update the connection using the correct tenant domain

🔄 Monitoring & Logs

AirMDR monitoring

Use the AirMDR application to review:

Connection status.
Skill execution status.
Execution start and completion times.
API error codes and error messages.
Remote Agent connectivity, when applicable.
The exact log location and displayed fields can vary according to the AirMDR module from which the skill was executed.

Tines audit logs
Tines automatically records changes made through both its UI and API. Tenant administrators can access audit logs through the Tines UI or API and forward them to a SIEM or log-analysis platform. API-key creation, editing, and deletion are logged as authentication-token operations. Sensitive credential values are not included in Tines audit logs.
Relevant audit operations include:
AuthenticationTokenCreation AuthenticationTokenEdit AuthenticationTokenDeletion
Sample Tines audit log
{ "created_at": "2026-08-14T10:30:00Z", "request_ip": "192.0.2.10", "tenant_id": 9, "user_email": "airmdr-service@example.com", "user_id": 123, "user_name": "AirMDR Integration", "operation_name": "AuthenticationTokenCreation" }
This sample illustrates the documented Tines audit-log structure. Actual values depend on the tenant and operation.

Recommended monitoring
- Monitor repeated 401, 404, 429, and 5xx responses.
- Review API-key creation, modification, and deletion events.
- Alert on unexpected activity from the AirMDR service account.
- Review the API key’s team roles and tenant permissions periodically.
- Monitor the AirMDR connection expiry date and planned key-rotation date.

🛑 Security & Access Best Practices

✅ Do

Use a dedicated Team or Service API key for AirMDR.
Follow the principle of least privilege.
Restrict a Team API key to the team AirMDR must access.
Store the API key only in approved secret-storage systems.
Rotate the key periodically and after any suspected exposure.
Set an AirMDR connection expiry date aligned with the rotation policy.
Review Tines audit logs for unexpected API-key activity.
Use HTTPS and validate certificates.
Use a Remote Agent for privately accessible self-hosted environments when required.
Delete unused or superseded keys promptly.

❌ Don’t

Do not use a Tenant owner API key unless full tenant access is explicitly required.
Do not use a personal API key for a long-running production integration.
Do not enter login.tines.com as the tenant domain.
Do not include /api/v1, /api/v2, team paths, or story paths in the Tenant Domain field.
Do not store API keys in documentation, source control, or plain-text files.
Do not send API keys through email, chat, or support tickets.
Do not reuse the AirMDR API key across unrelated integrations.
Do not log authentication headers or API-key values.

👉 Support & Maintenance

📧 Contact AirMDR Support through your designated support channel.
🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
🔄 Reconnect in AirMDR immediately when secrets are changed.

🛑 Data Flow & Security

Data flow

Direction	Data exchanged
AirMDR → Tines	Authenticated API requests required by the selected Tines skill
Tines → AirMDR	API responses containing permitted team, story, case, event, record, status, or execution information
AirMDR → Tines	Create, update, or execution requests only when supported by the selected skill and permitted by the API key

The exact information exchanged depends on the AirMDR skill being executed and the permissions assigned to the Tines API key.

Authentication flow

AirMDR sends an HTTPS request to the configured Tines tenant domain.
The Tines API key is supplied in the request authentication header.
Tines validates the key and its associated user, service account, team role, or tenant permissions.
Tines processes the request only when the key has access to the requested resource.
The API response is returned to AirMDR over HTTPS.

Encryption

Tines requires authenticated API communication over HTTPS.
Tines states that customer personal data is encrypted in transit using at least TLS 1.2.
Tines states that customer personal data stored at rest is encrypted using AES-256.
AirMDR should store the API key as a secret and must not expose it in skill inputs, logs, screenshots, or exported troubleshooting data.

Ports and endpoints

Requirement	Value
Protocol	HTTPS
Outbound port	TCP 443
Base endpoint	`https://<tenant-domain>`
API endpoint pattern	`https://<tenant-domain>/api/v1/...` or `/api/v2/...`
Authentication	Bearer token or `X-User-Token` header

No inbound connection from Tines is required for standard AirMDR-initiated API requests. If a supported workflow uses Tines webhooks, configure and secure the required inbound webhook separately

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Purpose

Supported Versions

Authentication

Pre-requisites

Setup Steps

Tines Credential Reference Table

Validate Connectivity

Configure Tines in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

AirMDR monitoring

Tines audit logs

Recommended monitoring

✅ Do

❌ Don’t

Data flow

Authentication flow

Encryption

Ports and endpoints

​Purpose

​Supported Versions

​Authentication

​Pre-requisites

​Setup Steps

​Tines Credential Reference Table

​Validate Connectivity

​Configure Tines in AirMDR Integrations Dashboard

​Skills provided by this Integration

​Additional Information

​AirMDR monitoring

​Tines audit logs

​Recommended monitoring

​✅ Do

​❌ Don’t

​Data flow

​Authentication flow

​Encryption

​Ports and endpoints

Purpose

Supported Versions

Authentication

Pre-requisites

Setup Steps

Tines Credential Reference Table

Validate Connectivity

Configure Tines in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

AirMDR monitoring

Tines audit logs

Recommended monitoring

✅ Do

❌ Don’t

Data flow

Authentication flow

Encryption

Ports and endpoints