Send to Story

Overview​ 

Teams regularly need to perform a task or a set of tasks in multiple different stories. For example, a threat intelligence story and a phishing response story may use the same procedure to analyze a URL, similarly a user de-provision story and a vulnerability management story may require the creation of a Jira ticket.

Rather than creating the same set of actions in multiple stories (thus violating the DRY-principle), Send to Story allows users create "sub-stories" to which events can be sent from other stories. When an event is received by a sub-story, the sub-story will perform its action and when finished, emit an event from the calling action.

❗️Important

Sub-stories​ 

Sub-stories work the exact same as normal Tines stories. The only difference being that a sub-story has an input action and an output action. The input action must be a webhook type action and the output action must be a message-only mode event transformation action.

Enabling a story for Send to Story (creating a sub-story)​ 

From a storyboard, when no actions are selected, in the properties panel there is a toggle to enable a story for Send to Story. When this toggle is turned on, you'll be asked to specify input and output actions. A sub-story can only have one input action and can have many output actions. Once an input action is defined, you can specify input parameters for your sub-story: the required inputs needed for your story to run.

Input​ 

When an event is sent to a sub-story, the input action will emit an event to its receiver actions. Input actions must be of type Webhook.

Send to Story inputs 

​Inputs are the defined values your sub-story needs to run. These will be auto-populated in the send to story action when your sub-story is specified. These inputs can also be updated on the webhook action itself.

⚠️Warning

Updates to send to story inputs 

You can update sub-story inputs from the configuration panel or the webhook editor at any time. Once updated, any send to story actions calling your sub-story will reflect these changes visually, but their editor configuration (<Editor> button on the action) will not change.

If you do not have any send-to-story inputs defined, the payload of the send-to-story action will be received by the input action. If you do have send-to-story inputs defined, regardless of the editor configuration defined on the send-to-story action, only the defined send-to-story inputs of your sub-story will be received by the input action. If you have a payload defined for a send-to-story action that doesn't have send-to-story inputs defined, and you add send-to-story inputs to the input action, the payload will be ignored. The payload will still be visible on the action configuration but it will be marked "ignored".

A send to story action that does not send all required inputs will fail and log an error that the call is missing required inputs.

Output​ 

The output actions are the last action in a sub-story and must be message-only mode event transformation actions. The content specified in the Exit action will be emitted by the send to story action that originally sent the event to the sub-story.

Access​ 

Controls who is allowed to send to this story. Either select 'All teams & drafts' to allow any team to send to this story, or select the team that owns the story to restrict access. Users can only grant access to teams for which they have the "story create" permission.

You can view all sub stories available to your team by clicking the "Shared with this team" section in the stories page. You will not be able to view or modify the contents of the story unless you have the relevant permissions in the team owning said story.

Need to share with other teams? Reach out to the team to discuss adding the feature to your Tines tenant.

Enable for 

Controls where this send to story can be used:

  • Send to Story: Story can be called via the Send to Story action

  • Workbench and Send to Story: Story can be called via the Send to Story action and Workbench.

  • Workbench: Story can only be called via Workbench and cannot run autonomously (i.e. scheduled actions will not run and the webhook will not accept events from outside of Workbench). Story will not be counted towards license count.

Sending to a sub story​ 

To send data to a sub-story, use a Send to Story action. Select the sub-story you would like to use and enter the required parameters.

When this action runs, it will send the inputted values to the defined sub-story. The input action in the sub-story will then emit an event similar to the below:

{
"webhook_action":{
  "#event_id":519633304,
  "#agent_id":398737,
  "body":{
    "ip_address": "8.8.8.8"
    }
  }
}

When this event reaches the defined output action, an event will be emitted at the calling Send to Story action that matches the Exit action's configuration.

In the example, the sub-story Analyze IP Address has the following data defined in its output action.

This same data is sent back to the Send to story action that called the sub-story.

View all stories calling your sub-story 

Within the overview pane of your sub-story, you can see all stories that you have access to that call your sub-story with a send to story action. In the example throughout this document, a story Alert processing story uses a send to story action to call the Analyze IP address sub-story. You can see this story listed within the sub-story as a story that calls it.

Retrieving event data from Story runs using Send to Story 

This feature is now documented under Workflows as APIs.

Was this helpful?