Tines

Tines stories report runs with one HTTP Request action at the end of the story. No SDK, no custom action: the standard HTTP Request action is the whole integration.

The action

Add an HTTP Request action as the story's final step:

Setting	Value
URL	https://your-lumatrack-host/api/v1/runs
Method	POST
Content type	JSON
Headers	Authorization: Bearer <API key> (store the key as a Tines credential, never inline)

Payload:

{
  "automation": "phishing-triage",
  "status": "success",
  "source": "tines",
  "external_id": "<<META.story_run_guid>>",
  "units": "<<alerts.count>>"
}

external_id from the story run GUID makes retried runs idempotent. units is optional: set it when one story run processes a variable batch (alerts triaged, mailboxes swept) and value the automation per unit.

Wire the failure path

A story that only reports success produces a number nobody should put in front of a leadership review. Duplicate the action on the error path (or in a story-level error handler) with "status": "failure" and a failure_reason naming the root cause; the reliability chart and the failure Pareto build from it.

What to use as the baseline

SOC automations usually replace analyst minutes: set the automation's manual baseline to the analyst time one triage takes (decompose it into baseline steps at the analyst's loaded rate for a figure that survives review), and let oversight minutes carry the spot-check time your team still spends.