{“lastseen”:”2025-09-19T11:09:09″,”description”:”\\n\\nRun by the team at workflow orchestration and AI platform Tines, the Tines library features over 1,000 pre-built workflows shared by security practitioners from across the community – all free to import and deploy through the platform’s Community Edition.\\n\\nThe workflow we are highlighting streamlines security alert handling by automatically identifying and executing the appropriate Standard Operating Procedures (SOPs) from Confluence. When an alert triggers, AI agents analyze it, locate relevant SOPs, and perform required remediation steps – all while keeping the on-call team informed via Slack.\\n\\nIt was created by Michael Tolan, Security Researcher L2 at Tines, and Peter Wrenn, Senior Solutions Engineer at Tines.\\n\\nIn this guide, we’ll share an overview of the workflow, plus step-by-step instructions for getting it up and running.\\n\\n## The problem – manual alert triage and SOP execution\\n\\nFor security teams, responding to alerts efficiently requires quickly identifying the threat type, locating the appropriate SOP, and executing the required remediation steps.\\n\\nFrom a workflow perspective, teams often have to:\\n\\n * Manually analyze incoming security alerts\\n * Search through Confluence for relevant SOPs\\n * Document findings and actions in case management systems\\n * Execute multiple remediation steps across different security tools\\n * Update the case management system again after the fact\\n * Notify stakeholders about incidents and actions taken\\n\\n\\n\\nThis manual process is time-consuming, prone to human error, and can lead to inconsistent handling of similar alerts.\\n\\n## The solution – AI-powered alert triage with automated SOP execution\\n\\nThis prebuilt workflow automates the entire alert triage process by leveraging AI agents and Confluence SOPs. The workflow helps security teams respond faster and more consistently by:\\n\\n * Using AI to analyze and classify incoming alerts\\n * Automatically locating relevant SOPs in Confluence\\n * Creating structured case records for tracking\\n * Deploying a second AI agent (subagent) to execute remediation steps\\n * Documenting all actions and notifying the on-call team via Slack\\n\\n\\n\\nThe result is a streamlined response to security alerts that ensures consistent handling according to established procedures.\\n\\n## Key benefits of this workflow\\n\\n * Reduced mean time to remediation (MTTR)\\n * Consistent application of security procedures\\n * Comprehensive documentation of all actions taken\\n * Reduced analyst fatigue from repetitive tasks\\n * Improved visibility through automated notifications\\n\\n\\n\\n## Workflow overview\\n\\n### **Tools used:**\\n\\n * Tines – workflow orchestration and AI platform (free Community Edition available)\\n * Confluence – knowledge management platform for SOPs\\n\\n\\n\\n_This specific workflow also_ uses _the following pieces of software. However, you can use whatever enrichment\/_ remediation _tools currently_ existing within _your technology stack alongside Tines and Confluence._\\n\\n * CrowdStrike – threat intelligence and EDR platform\\n * AbuseIPDB – IP reputation database\\n * EmailRep – email reputation service\\n * Okta – identity and access management\\n * Slack – team collaboration platform\\n * Tavily – AI research tool\\n * URLScan.io – URL analysis service\\n * VirusTotal – file and URL scanning service\\n\\n\\n\\n## How it works\\n\\n### Part 1: Alert Ingestion and Analysis\\n\\n * Receive security alert from integrated security tools\\n * AI agent analyzes the alert to determine type and severity\\n * System searches Confluence for relevant SOPs based on alert classification\\n * Create a case record with alert details and identified SOP\\n\\n\\n\\n### Part 2: Remediation and Documentation\\n\\n * Second AI agent reviews the case and SOP instructions\\n * AI agent orchestrates remediation actions across appropriate security tools\\n * All actions are documented in the case history\\n * Slack notification is sent to the on-call team with alert details and actions taken\\n\\n\\n\\n## Configuring the workflow – step-by-step guide\\n\\n1\\\\. Log into Tines or create a new account.\\n\\n\\n\\n2\\\\. Navigate to the pre-built workflow in the library. Select import.\\n\\n\\n\\n#### 3\\\\. Set up your credentials\\n\\n\\n\\nYou’ll need credentials for all the tools used in this workflow. You can add or remove whatever tools you wish to suit your environment. \\n\\n * Confluence\\n * CrowdStrike\\n * AbuseIPDB\\n * EmailRep\\n * Okta\\n * Slack\\n * Tavily\\n * URLScan.io\\n * VirusTotal\\n\\n\\n\\nFrom the credentials page, select New credential, scroll down to the relevant credential and complete the required fields. Follow the credential guides at explained.tines.com if you need help.\\n\\n#### 4\\\\. Configure your actions.\\n\\nSet your environment variables. In this particular workflow, that specifically requires setting the Slack channel for notifications (hardcoded to #alerts by default, but can be adjusted in the Slack action).\\n\\n#### 5\\\\. Customize the AI prompts\\n\\nThe workflow includes two key AI agents:\\n\\n * Alert Analysis Agent: Customize the prompt to help identify alert types\\n * Remediation Agent: Customize the prompt to guide remediation actions\\n\\n\\n\\n#### 6\\\\. Test the workflow.\\n\\nCreate a test alert to verify:\\n\\n * Alert is properly classified\\n * Correct SOP is retrieved from Confluence\\n * Case is created with appropriate details\\n * Remediation steps are executed\\n * Slack notification is sent\\n\\n\\n\\n#### 7\\\\. Publish and operationalize\\n\\nOnce tested, publish the workflow and integrate with your security tools to begin receiving live alerts.\\n\\nIf you’d like to test this workflow, you can sign up for a free Tines account.\\n\\nFound this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.\\n”,”published”:”2025-09-19T11:00:00″,”modified”:”2025-09-19T11:00:00″,”type”:”thn”,”title”:”How To Automate Alert Triage With AI Agents and Confluence SOPs Using Tines”,”source”:””,”references”:””,”id”:”THN:9F149DC6CEEC94C434D9EAE93FBEED9F”,”bulletinFamily”:”info”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/thehackernews.com\/2025\/09\/how-to-automate-alert-triage-with-ai.html”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-19T11:09:09″,”description”:”\\n\\nRun by the team at workflow orchestration and AI platform Tines, the Tines library features over 1,000 pre-built workflows…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,11,43,5],"class_list":["post-18075","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-thn","tag-vulnerability"],"yoast_head":"\n