Reducing false positives with automated SIEM investigations from Elastic and Tines

This post details how Elastic's InfoSec team uses Tines to automate the initial investigation of SIEM alerts, specifically focusing on reducing false positives. The core technical contribution is the implementation of an automated triage workflow that queries Elasticsearch using the _search API based on alert tags (e.g., 'Triage:Asset', 'Triage:PMFA', 'Triage:Workstation'). These queries check for activity from trusted sources (managed workstations, internal network zones, authorized third-party applications, phishing-resistant MFA) to automatically close benign alerts. Alerts that do not meet these criteria are escalated for human investigation. The post highlights the use of the Signals API to set alert status and the Alert Actions feature in Elastic Security to send alerts to Tines via a Tines connector or Webhook. It quantifies the impact, stating that over 3,000 alerts are triaged daily without human interaction, preventing the need for an estimated 94 additional SOC personnel.