Dropzone AI vs Tines (2026)

Dropzone has more than 90 integrations across SIEM, EDR, cloud, identity and email, read only by default. Response Actions run Python that the customer writes in an isolated container with stored secrets injected, to notify external systems, trigger remediation and apply policy actions.

Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-10-22

HTTP Request actions call any tool with an API using tenant credentials. Unlimited connectors come on every edition, and library stories let agents act in CrowdStrike, Jira, Slack, Azure Sentinel, AWS and others with the customer's own credentials. Further library stories work with Code42, Reality Defender and Google Threat Intelligence, Send Email actions deliver mail from a story, and Workbench and the AI Agent action can call remote MCP servers as tools. The free edition already includes unlimited users, spaces and connectors.

SourceTines, tines.com/library, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/actions/typesread 2026-10-05

Beyond the agent's own multi step investigation, customers configure what follows it. Response Automations fire on more than 50 triggers, among them an investigation completing with a given status, and run the customer's own code, and versioned custom strategies set priority rules and investigation questions.

Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-09-28

Teams build stories from webhook, email, HTTP request, condition, event transform, Send to Story and AI Agent actions, chaining stories and agents into their own flows. The AI Agent action runs in task mode, as a one shot prompt or an autonomous agent that calls tools toward an objective, or in chat mode on a Tines page where users talk to it until a set goal is met. Its tools can be public or custom templates, other stories attached through Send to Story with their own timeouts, custom tools built in the same story and remote MCP servers, and Condition actions branch a story's path.

SourceTines, tines.com/docs AI Agent action and action types; tines.com/stories/docs/actions/typesread 2026-10-05

Every alert the connected tools raise starts an investigation, hunts run on a schedule and on new CVEs and campaigns, and response automations fire on more than 50 system triggers.

Sourcedropzone.airead 2026-10-22

Webhook actions start stories on inbound events from external services, and Receive Email actions start them on inbound mail, without a prompt. An AI Agent in chat mode sits on a Tines page where people start conversations, and Workbench takes Cases and events sent to it. Outside AI clients can also run stories through the Tines MCP server.

SourceTines, tines.com/stories/docs/actions/types, Workbench and AI Agent action docsread 2026-10-05

Investigations query the customer's own tools live through the integrations, and analysts set custom strategies and define normal behavior. Context Memory serves as the persistent store, and no separate maintained index over the customer's documents is described.

Sourcedocs.dropzone.ai/platform/settings/custom-strategiesread 2026-09-28

Workbench reaches the customer's proprietary data in real time by running stories as tools, and Records and Resources hold structured data for stories. Tines offers no published knowledge base or search index for the AI to draw on. Users can send Cases and events into Workbench for context and attach images or documents of up to 4.5 MB, three to a message, and skills hold reusable task instructions written in place or imported as markdown files.

SourceTines, tines.com/stories/docs/workbenchread 2026-10-05

Context Memory holds institutional facts across investigations. The agent writes to it when analysts change a conclusion, users add notes directly, and it can be reached through the API. Its scope and lifetime are not stated, and Dropzone only advises cleaning it up from time to time.

Sourcedocs.dropzone.ai/platform/context-memoryread 2026-09-28

Workbench keeps chat history that users can search, rename and delete, and Records persist structured data across story runs. Tines does not describe the AI Agent action remembering anything from one run to the next. How long chat history is kept depends on the plan, users can set custom instructions for their conversations, and an agent in chat mode keeps the conversation going until its goal is met.

SourceTines, tines.com/stories/docs/workbench and tines.com/docs AI Agent actionread 2026-10-05

Analysts approve or reopen each investigation in the product and from Slack (/dzapprove, /dzreopen), access to the customer's tools is read only by default, and response actions run only where the customer has configured them.

Sourcedocs.dropzone.ai/integrations/tools/slack-chatopsread 2026-09-28

In Workbench, templates that may change the environment "will prompt the user to confirm before running", and any story can be set to "Require confirmation to run". The story then waits for a person to approve it before anything runs. The library includes a story for requesting and approving Slack posts to a restricted channel. Admins allocate AI credits to teams, and token use thresholds can send a notification or switch the AI Agent action off.

SourceTines, tines.com/stories/docs/workbench, tines.com/library and tines.com/docs AI Agent actionread 2026-10-05

Users sign in locally or through Microsoft, Google or a SAML provider such as Okta or Microsoft Entra, under three roles, Administrator, Member and Restricted Read Only. Dropzone holds SOC 2 Type 2, following a Type 1 audit by Sensiba, runs an annual third party penetration test and a trust center at trustcenter.dropzone.ai, and uses no customer data to train models.

Sourcedropzone.ai/security-privacy-trustread 2026-10-22

Tines holds SOC 2 Type II, audited annually, with reports in the trust center. SSO/SAML comes on all plans, along with teams that separate users, credentials, resources and stories, user administration, IP access control and action egress control. Workbench gives each user only the credentials and stories their permissions allow, and AI providers can be scoped to specific teams, with the team that owns a provider's credential always keeping access.

SourceTines, tines.com/security, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05

Each investigation produces an evidence backed report that shows the agent's reasoning, and every response action's output, errors and execution status are logged for auditing.

Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-09-28

Every action in a story emits events that record each step of a run. All actions performed in Workbench are available in audit logs, and an audit log is captured whenever a user changes data in the tenant. Every agent run appears in those events and logs. Token use is tracked against each team's AI credit allowance, with notifications as a team nears its limit.

SourceTines, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05

Each customer gets a dedicated tenant in its own AWS subnet, normally in us-west-2, with optional regional deployments and in-region EU deployment on request for GDPR. An optional connector reaches security tools the customer runs on premises, and the Enterprise plan includes a dedicated single tenant environment.

Sourcedropzone.ai/security-privacy-trustread 2026-10-22

Tines is both a cloud service that Tines hosts and a product that customers can host themselves. Self hosted Tines runs in the customer's environment on AWS ECS and EKS, Azure, Google Kubernetes Engine, Red Hat OpenShift, VMware and Docker Compose, and paid editions list flexible deployment options. The hosted service also has an EU stack, where web search is limited by egress restrictions. The free edition runs three live workflows, and paid editions remove the limit.

SourceTines, tines.com/stories/docs/self-hosted, /pricing and tines.com/stories/docs/workbenchread 2026-10-05

Two agents ship, each doing its own job, the AI SOC Analyst for alert investigation and the AI Threat Hunter for hypothesis driven hunts, with prebuilt hunt packs such as APT29. An AI Threat Intel Analyst is planned that turns each new CVE or campaign into a hunt pack for the Threat Hunter, and COACH, a free Chrome extension, walks analysts through an alert step by step.

Sourcedropzone.airead 2026-10-22

Customers import prebuilt stories from a public library, including AI agent templates such as triaging Azure Sentinel incidents with an AI Agent and looking up IOCs via Slack using an agent.

The library spans security, IT operations, infrastructure, engineering, product, asset and app management, employee lifecycle, incidents and alerts, communication and ticket synchronization, with stories such as analyzing SMS messages for scams with OCR and AI, containing or releasing CrowdStrike hosts from Jira and detecting deepfakes with Reality Defender. Workbench adds prebuilt templates that need only credentials, and team admins can package tools, credentials and instructions as Presets.

SourceTines, tines.com/library and tines.com/stories/docs/workbenchread 2026-10-05

Dropzone runs on several named LLM services, including Anthropic, Azure OpenAI and Perplexity, and chooses among them itself. Customers cannot choose the model.

Sourcedropzone.ai/security-privacy-trustread 2026-10-22

AI features run on Anthropic's Claude through AWS Bedrock by default, and "it is possible to bring your own AI provider to power all of our AI features", scoped to teams by credential. Bring your own model is listed on paid editions. Admins can set separate smart and fast models, providers brought in can be OpenAI, Anthropic, Azure OpenAI, Helicone, OpenRouter, xAI or Ollama, and each AI Agent action picks its own model from those available. The free edition comes with a one time $50 AI allowance.

SourceTines, tines.com/stories/docs/admin/ai, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/adminread 2026-10-05

Developers get a REST API under /app/api/v1 with Api-Key authorization that covers investigations, bulk feedback, user notes, context memory, custom strategies, response actions and system events, with an OpenAPI 3.0.3 spec and a Swagger UI in the product.

Sourcedocs.dropzone.ai/apiread 2026-09-28

Developers get the Tines API, Terraform support and a Tines MCP server at https://your-tenant.tines.com/mcp with OAuth, whose tools read, create, update, validate and run stories and actions from outside AI clients.

Sourcetines.com/stories/docs/mcp-serverread 2026-09-28

Analysts record feedback on investigations singly or in bulk and can reopen a conclusion, reviewing the agent's output after the fact. There is no evaluation harness, scored test set or gate before a strategy change goes live.

Sourcedocs.dropzone.ai/apiread 2026-09-28

Story contents can be validated before they run, and a validation tool is exposed through the MCP server; both check the story's configuration. Tines publishes no way to run an AI Agent action against test cases and score its answers. An output schema can make the AI Agent action return JSON that is validated against it, and each action sets its own temperature from 0 to 1.

SourceTines, tines.com/stories/docs/mcp-server and tines.com/docs AI Agent actionread 2026-10-05

The agent queries the customer's tools through their APIs, and driving a browser, desktop or remote computer is not described.

Sourcedropzone.airead 2026-09-28

Browser or screen use by Tines agents is not described. Tines acts through API actions. The AI Agent action's built in tools are a planning scratchpad, code analysis and web search, which fetches page content for the agent to read.

SourceTines, tines.com/stories/docs/actions/types and tines.com/docs AI Agent actionread 2026-10-05