{"id":7895,"date":"2025-07-09T06:36:56","date_gmt":"2025-07-09T06:36:56","guid":{"rendered":"http:\/\/localhost\/?p=7895"},"modified":"2025-07-09T06:36:56","modified_gmt":"2025-07-09T06:36:56","slug":"how-to-automate-ticket-creation-device-identification-and-threat-triage-with-tines","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=7895","title":{"rendered":"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines"},"content":{"rendered":"

Security Update News<\/h2>\n

Update Information<\/h3>\n\n\n\n\n\n\n
Title<\/th>\nHow To Automate Ticket Creation, Device Identification and Threat Triage With Tines<\/td>\n<\/tr>\n
Update ID<\/th>\nTHN:8A4BEEAD3E1D1A8E29FB3F0DF3B027AB<\/td>\n<\/tr>\n
Type<\/th>\nthn<\/td>\n<\/tr>\n
Published<\/th>\n2025-07-09T11:00:00<\/td>\n<\/tr>\n
Last Updated<\/th>\n2025-07-09T11:00:00<\/td>\n<\/tr>\n<\/table>\n

Security Impact<\/h3>\n\n\n
Severity<\/th>\nNONE<\/td>\n<\/tr>\n<\/table>\n

Update Details<\/h3>\n
\n![](data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)<\/p>\n

Run by the team at workflow orchestration and AI platform Tines, the Tines library features over 1,000 pre-built workflows shared by security practitioners from across the community – all free to import and deploy through the platform’s Community Edition.<\/p>\n

A recent standout is a workflow that handles malware alerts with CrowdStrike, Oomnitza, GitHub, and PagerDuty. Developed by Lucas Cantor at Intercom, the creators of fin.ai, the workflow makes it easier to determine the severity of a security alert and escalate it seamlessly, depending on the device owner’s response. “It’s a great way to reduce noise and add context to security issues that are added on our endpoints as well,” Lucas explains.<\/p>\n

In this guide, we’ll share an overview of the workflow, plus step-by-step instructions for getting it up and running.<\/p>\n

## The problem – lack of integration between security tools <\/p>\n

For security teams, responding to malware threats, analyzing their severity, and identifying the device owner so they can be contacted to resolve the threat, can take up a lot of time. <\/p>\n

From a workflow perspective, teams often have to:<\/p>\n

* Manually respond to CrowdStrike events
* Enrich the alert with additional metadata
* Document and alert the device owner in Slack
* Notify on call teams via PagerDuty<\/p>\n

Going through this process manually can result in delays and increase the chances of human error. <\/p>\n

## The solution – automated ticket creation, device identification, and threat triage<\/p>\n

Lucas’s prebuilt workflow automates the process of taking the malware alert and creating the case – while crucially notifying the device owner and the on-call team. This workflow helps security teams accurately identify the level of threat faster by: <\/p>\n

* Detecting new alerts from Crowdstrike
* Identifying and notifying the device owner
* Escalating critical issues<\/p>\n

The result is streamlined response to malware security alerts that ensures they are dealt with quickly, no matter what the severity. <\/p>\n

Key benefits of this workflow: <\/p>\n

* Reduced remediation time
* Device owner is kept informed
* Clear remediation and escalation pathways
* Centralized management system<\/p>\n

## Workflow overview<\/p>\n

### **Tools used:**<\/p>\n

* Tines – workflow orchestration and AI platform (free Community Edition available)
* Crowdstrike – threat intelligence and EDR platform
* Oomnitza – IT asset management platform
* Github – developer platform
* PagerDuty – incident management platform
* Slack \u2013 team collaboration platform<\/p>\n

### **How it works**<\/p>\n

#### **Part 1**<\/p>\n

* Get a security alert from CrowdStrike
* Find the device that the alert was triggered and look up its details
* Create a ticket in GitHub for the alert and raise the issue in a Slack message
* If the device is owned by a user and it is a low priority,
* Send the owner a message requesting escalation
* If the device is owned by a user and it is a high priority,
* Create a PagerDuty Event to notify the on-call analyst
* Informing the owner of the ongoing issue<\/p>\n

#### **Part 2**<\/p>\n

* Get a user interaction with the Slack message
* Enrich the GitHub issue with the users response
* If the owner escalates the issue
* Create a PagerDuty Event to notify the on-call analyst<\/p>\n

## Configuring the workflow – step-by-step guide <\/p>\n

![](data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)<\/p>\n

**1.** Log into Tines or create a new account.<\/p>\n

**2.** Navigate to the pre-built workflow in the library. Select import. This should take you straight to your new pre-built workflow.<\/p>\n

**3.** Set up your credentials<\/p>\n

![](data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)<\/p>\n

You’ll need five credentials added to your Tines tenant:<\/p>\n

* CrowdStrike
* Oomnitza
* Github
* PagerDuty
* Slack<\/p>\n

Note that similar services to the ones listed above can also be used, with some adjustments to the workflow. <\/p>\n

From the credentials page, select New credential, scroll down to the relevant credential and complete the required fields. Follow the CrowdStrike, Oomnitza, Github, PagerDuty, and Slack credential guides at explained.tines.com if you need help.<\/p>\n

**4.** Configure your actions. <\/p>\n

* Set your environment variables. This includes your:
* Slack IT channel alerting webhook (`slack_channel_webhook_urls_prod`)
* CrowdStrike\/GitHub severity priority mapping (`crowdstrike_to_github_priority_map`)
* Configure CrowdStrike to alert the New CrowdStrike Detection webhook when a detection is created
* Configure your SlackBot interactivity URL to the Receive Slack Button Push webhook<\/p>\n

**5.** Test the workflow. <\/p>\n

**6.** Publish and operationalize<\/p>\n

Once tested, publish the workflow. <\/p>\n

If you’d like to test this workflow, you can sign up for a free Tines account.<\/p>\n

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter _\uf099_ and LinkedIn to read more exclusive content we post.\n<\/div>\n

View Advisory Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Security Update News Update Information Title How To Automate Ticket Creation, Device Identification and Threat Triage With Tines Update ID THN:8A4BEEAD3E1D1A8E29FB3F0DF3B027AB Type thn Published 2025-07-09T11:00:00…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,11,43,5],"class_list":["post-7895","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-thn","tag-vulnerability"],"yoast_head":"\nHow To Automate Ticket Creation, Device Identification and Threat Triage With Tines - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=7895\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Security Update News Update Information Title How To Automate Ticket Creation, Device Identification and Threat Triage With Tines Update ID THN:8A4BEEAD3E1D1A8E29FB3F0DF3B027AB Type thn Published 2025-07-09T11:00:00...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=7895\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-09T06:36:56+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=7895#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=7895\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines\",\"datePublished\":\"2025-07-09T06:36:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=7895\"},\"wordCount\":817,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"exploit\",\"news\",\"NONE\",\"Security\",\"tapic\",\"thn\",\"Vulnerability\"],\"articleSection\":[\"category_news\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=7895#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=7895\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=7895\",\"name\":\"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-07-09T06:36:56+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=7895#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=7895\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=7895#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=7895","og_locale":"en_US","og_type":"article","og_title":"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines - zero redgem","og_description":"Security Update News Update Information Title How To Automate Ticket Creation, Device Identification and Threat Triage With Tines Update ID THN:8A4BEEAD3E1D1A8E29FB3F0DF3B027AB Type thn Published 2025-07-09T11:00:00...","og_url":"https:\/\/zero.redgem.net\/?p=7895","og_site_name":"zero redgem","article_published_time":"2025-07-09T06:36:56+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=7895#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=7895"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines","datePublished":"2025-07-09T06:36:56+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=7895"},"wordCount":817,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","exploit","news","NONE","Security","tapic","thn","Vulnerability"],"articleSection":["category_news"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=7895#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=7895","url":"https:\/\/zero.redgem.net\/?p=7895","name":"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-07-09T06:36:56+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=7895#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=7895"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=7895#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"How To Automate Ticket Creation, Device Identification and Threat Triage With Tines"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/7895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7895"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/7895\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}