Cases is Tines' case management solution: a shared, real-time workspace where people coordinate on security and operations work. Where automation handles your established, repeatable processes, a case gives your team somewhere to track, enrich, and resolve, by commenting, taking action, and reporting on progress together.
A single case pulls the relevant people, context, and next steps into one place. Cases live independently of Tines 3B so your workflow reaches them over the Tines API: you connect once through the Tines Stories connector, then a workflow can interact with a case.
Key building blocks
A case is made up of a few core pieces:
Status and priority. Every case has a status (open or closed, with optional sub-statuses for finer stages) and a priority that signals how urgent it is.
Assignees. Cases are assigned to the people responsible for the work, so it's always clear who owns what.
The case body. The body is built from blocks, including rich-text notes, files, and other content that capture the investigation and its findings.
Comments and timeline. People collaborate in real time through comments, and a timeline records the granular changes made to the case as an activity log.
Fields. Fields are structured values on a case, for example an alert ID or a risk score. Field definitions are shared across a team, and each case holds its own values.
Tags, SLAs, and actions. Tags help you organize and correlate cases, SLAs track how quickly work needs to happen, and actions (buttons on a case) trigger your existing Tines automations by webhook or page.
Records
Cases work best alongside records, which are structured and queryable tables that hold event data.
A record type defines the typed fields, and each record is a row of values. Records can stand on their own, and can also be linked to one or more cases, for example when it's a piece of evidence in an investigation. From a Tines 3B workflow, records sit under the same Tines Stories connector as cases.
Customization
Cases adapt to your team's process rather than the other way around. You can define your own statuses and sub-statuses, tags, closure requirements, SLAs, and custom roles, and you can capture every change through case webhook notifications so your workflows can respond to what happens on a case.
Common use cases
Cases suits any work that needs people in the loop:
Alert triage. Turn an incoming alert into a case so your team can investigate, enrich, and decide together.
Investigations. Gather evidence, notes, and linked records in one shared workspace.
Exception handling. Route the unusual or the uncertain to a human when automation alone shouldn't decide.
Approvals and follow-up. Pause a workflow for a human decision, then continue once the case moves forward.