About Fortune Brands Innovations
Fortune Brands Innovations is a leading provider of home, security, and commercial building products and services. The Illinois-headquartered business has a long track record of innovation in the space. Among other things, its companies have produced the world’s first laminated steel padlock, single-handle faucet, wood-core storm door, and the first-ever fiberglass door.
Executive summary
The SecOps team at Fortune Brands Innovations need to automate reliably and repeatably at scale. Tines and Tines-powered AI copilot Workbench fits seamlessly into their tech stack, empowering the team to increase capacity, optimize key processes, enable more efficient decision-making, and enhance overall security posture through a variety of use cases. Plus, they expect the list of potential workflows to grow exponentially in the future.
The challenge
As a SaaS-first business, Fortune Brands needs orchestrating automation capabilities that run between its various siloed cloud services. They previously relied on manual scripting, which Security Operations Engineer, Taylor Rainwater, found unstable and labor-intensive.
“Every time we wanted to automate something with manual scripting, we had to figure out exactly what it was that we wanted to do, to be able to perform the action,” he explains. “It was just so inconsistent that it became almost a custom solution. There was no repeatability.”
Their bundled workflow solution posed challenges when handling larger, more complex workflows.
“It was really an automation platform for one particular tool,” Taylor says. “It wasn't meant to be a general automation platform, and it wasn’t designed to do it at scale. It was hard to do anything more complex outside of the scope of that tool. There was no repeatability, and it required a lot of artificial complexity because of the way data was processed.”
He adds, “That’s why we looked for something that was a good fit for a general-purpose automation platform.”
Why Tines
Taylor and his team found Tines highly intuitive and perfectly matched to their goals.
“Say we've got a set of data I need to parse, and I need all kinds of branching actions. If I wanted to do it with our previous tools, I would have to make an entirely separate workflow for every single potential branch in the logic. That’s just unreasonable,” he explains.
Using Tines was like putting on a glove that fits perfectly the first time, because the platform fit exactly with what we needed and what we wanted to do.
Taylor Rainwater, Security Operations Engineer
Tines was scalable enough to support the team's ambition for repeatable automation and the exponential expansion of their projects.
The impact
With Tines and Tines Workbench, the security team at Fortune Brands Innovations has increased their capacity, optimized processes, and enhanced the organization’s security posture.
Time savings
Taylor says his team is saving a considerable amount of time on response actions with Tines workflows, including significantly reducing the time it takes to triage phishing alerts.
Optimizing processes
Tines’ flexibility has enabled the FBIN Security Operations team to build repeatable workflows across their organization. Using Pages, they’ve developed applications that streamline communication between the security team and other departments. Taylor has also built custom apps on behalf of other teams, for tasks like account lookups and data updates. This adaptability allows them to quickly deploy new applications whenever the need arises.
“If someone comes to me and needs to check something regularly, or the service desk needs to figure out if something's going on with a particular host, the first thing that crosses my mind is, ‘Hey, I can just make this into an app,’” he says.
Improved decision-making and efficiency with Tines Workbench
Since adopting Workbench, Tines’ universal AI copilot, a few months ago, Fortune Brands Innovations has already seen a significant impact on its security operations. The security team is using Workbench to quickly gather and analyze data from various tools, reducing friction in critical processes.
A big win has been simplifying interactions with tools like Splunk, which typically requires extensive training. Now, instead of navigating intricate queries, the team can simply ask Workbench a question and receive actionable insights instantly.
Another popular use case for Workbench is vulnerability management. The team uses it to quickly identify hosts in their vulnerability management platform that are impacted by specific CVEs, enabling them to prioritize patching and remediation more efficiently.
Workbench is also accelerating decision-making, delivering critical insights in hours rather than days.
We are just starting our journey with Workbench, but it has already changed the way we approach key aspects of our incident response process. Every day, we're treating Workbench more like another agent on the security team, rather than just a launching point for specific automation use cases.
Noah Baldwin, Senior Information Security Manager
Looking ahead, the team is excited about Workbench’s potential to empower leadership with quick, data-driven answers without disrupting security operations - an efficiency boost that could save hundreds of hours annually. By increasing productivity and providing seamless access to key insights, Workbench is proving to be a valuable asset to the team.
Improving security efficiency
Taylor shares that Tines has enabled speedier and more complete incident reporting. Previously, security team members had to manually search for details that should have been included in reports, slowing down the process. With Tines Pages, the workflow is now much simpler.
“Now we have a Pages workflow that allows personnel to take a CSV, and upload it. Then it spits back an updated version of the CSV that contains the information they need.”
Empowering teams to be more secure
Security team members can save significant time and effort sourcing information on vulnerabilities, thanks to Tines Pages and workflows that return intelligence on specific host names or CVEs without needing to access the admin console.
This workflow helps because it empowers folks that are more management-inclined to search for that information themselves, without needing the knowledge of how to use the admin console.
Taylor Rainwater, Security Operations Engineer
Top use cases
IoC management/enrichment
Phishing reporting and response
Automatic blocking of public IoCs
Top workflows
Phishing automation
This Tines workflow transforms the phishing alert response process - researching, triaging, and reporting. It also uses Records to keep track of all phishing events, which used to be a manual note-taking process.
Agent monitoring
Taylor shares how Tines enhances agent monitoring, ensuring seamless operation and swift responses to potential issues.
“Our IDP-specific automation tool has these things called Active Directory agents. We monitor the status of those, and if they go offline, which could potentially impact users, we'll get alerting there,” says Taylor.
“It also can enrich some of the information around that, including last status and last error code, and gather information on the host that the agent's running on.”
Automated reporting and records management
Tines automatically pulls information from key sources including IP ranges and stores them for future reference or to feed into other systems.
“Another example is, we can pull IP ranges from this source and then put them into a network zone within our identity provider software. That’s easily done with Tines,” says Taylor. “Rather than statically set up a network zone and then manually put in the IPs, and then have to set a reminder to go refresh it, this happens automatically. It gives us the confidence that the information we have is accurate and always being updated.”
Pages
Interact with and share insights from the workflow through simple, elegant webpages.
Records
Create custom reports by capturing builder-defined parameters across workflows.
Building apps
Tines workflows have helped Taylor and his team create impactful applications, such as a security health check page that confirms if new endpoints have the correct security agents installed. An administrator may have spent half a day on the task before, and now the workflow completes it in a minute or two, Taylor explains.
“The workflow pulls all the information from all of our potential sources that they would need to check, and then gives the user a summary of that information fairly quickly, so it helps them a lot.”
Another workflow uses Tines Pages to help them work out the origin of account lockouts. And a third sits on employee workstations and confirms if and why specific web pages get blocked by the firm’s security tools.
“I was able to make something that allows the service desk to go in and check for themselves,” Taylor shares.
Favorite feature
When asked about his favorite feature in Tines, Taylor pointed to the platform’s seamless data processing capabilities. “Probably the way the tool guides your hand in managing data flow,” he explains.
“One of my favorite things about Tines is how easy it is to process data. Tines makes it straightforward. You’re not bending over backward to process an array of information.
The data processing is beautiful - there’s no need for Regex or complex parsing to get specific information. You can just provide the key path, and boom, you've got the value.
Taylor Rainwater, Security Operations Engineer
Tines support
Taylor has been delighted with the quality and speed of Tines’ customer support.
“They don’t waste any time getting us an answer for what we need,” he explains. “A lot of times, when you're first getting used to Tines, you can overthink how to solve a problem. Then the team can provide either a direct solution for the exact scenario that you're looking at, or something equivalent.”
What’s next
Despite having achieved so much already with Tines and Tines Workbench, Taylor and the Fortune Brands Innovations team have a lengthy to-do list. It starts with enhancing connectivity between different tools and services.
“One thing that I'm going to be focusing on here soon is building modular functions for doing common tasks in different tools,” he says. “So when we want to connect this new tool to an existing tool, to be able to perform X and Y actions, I'll already have a modular function whereby I can just call a webhook over to that action and perform it in a repeatable way.”
There’s also a ticket synchronization workflow that will pull information from two ticketing systems running on the same platform, and feed it into another system bi-directionally.
The more you build in Tines, the more potential you create to build.
Taylor Rainwater, Security Operations Engineer