Connect cloud apps, internal APIs and on-premises systems with one integration platform. Start from 4,000+ products and 200,000+ API operations, with credentials and governance in place from day one.

This automation receives notable security alerts, locates the corresponding notable event through a controlled search process, and updates its status with a comment in the security platform. It also monitors search completion and emails an administrator when the search fails.

This automation investigates the actions performed during a single Azure Active Directory session after a suspicious event. It retrieves the relevant audit history, organizes key activity details into a Workbook, and shares the completed report back with the investigating team.

This automation analyzes reported phishing emails by checking sender reputation, scanning embedded URLs, evaluating attachments, and using an AI agent to determine whether security involvement is required. It consolidates the findings into a report and posts the assessment to a Slack channel for team awareness and action.

This scheduled automation refreshes reporting permissions, locates the configured workspace report, exports it as a presentation file, and emails the completed report to designated recipients. It replaces the recurring manual process of downloading and distributing reports with a consistent, scheduled delivery.

This automation investigates a remote user's current DNS resolver by retrieving the user's managed device inventory, extracting and parsing resolver data, and comparing it with the authorized resolver. If the resolver is unauthorized, it sends a notification to the initiating Slack channel.

This automation continuously reviews scheduled password-manager login events and investigates IP addresses that do not match known user or device activity. It produces contextualized security notifications for suspicious events so the security team can follow up on potential account compromise.

This automation receives bulk update data, authenticates with Salesforce, and processes Asset record updates through a batched ingest job. It monitors batch progress, marks the job complete, and posts a status message to a Slack channel.

This automation performs scheduled scans of the company domain to identify email addresses exposed in known breaches, then initiates password remediation for affected accounts. It delivers the breach details and remediation activity to a designated Slack channel so security teams can act from a centralized notification.

This automation analyzes forwarded emails for phishing indicators by checking the sender IP, qualifying URLs, and attachments against reputation data. When malicious activity is identified, it moves the message to trash and sends the security team a contextual Slack alert with investigation details.

This automation turns an incoming email-triggered request into a text-message submission after performing two validation lookups. It reduces the need for operators to inspect the request, repeat validation checks, and initiate the message manually.

This automation captures new form responses and appends their submitted values to a spreadsheet automatically. It replaces recurring manual data entry with a consistent, centralized record of incoming responses.

This automation receives third-party vulnerability scan CSV files, converts them into the required HOST asset format, validates the resulting data, and imports it automatically. It removes repetitive file preparation and provider setup work while delivering consistently formatted asset records for processing.

This automation reviews user-owned mobile devices in Google Workspace, identifies devices whose last synchronization is more than three months old, removes them, and posts a consolidated removal report in Slack. It replaces repeated inventory review, date comparison, deletion, and reporting with one automated process.

This automation identifies AWS EC2 instances that are missing required tags, notifies a designated Slack channel, and applies the required tags automatically. It then updates the Slack notification to show that tagging is complete.

This scheduled automation gathers user access, administrative status, authentication, device, and membership details from multiple business systems, then consolidates them into a structured access review report. It formats, exports, and uploads the report as compliance evidence to the configured controls.

This automation sends an on-demand MFA push challenge to a specified user after locating the account and an enrolled verification factor. It monitors the challenge and posts a success or timeout notification to the security team.

This automation monitors GitHub organization and repository activity, routes supported events by type, and sends severity-labeled alerts with the relevant actor and resource details. For sensitive actions such as publicizing a repository, creating a team, inviting a user, or creating a repository, it requests a human decision before applying the selected remediation.

This automation initiates firmware upgrades for a designated list of firewalls, checks the result of each equipment upgrade, and tracks failures. After processing the list, it sends the team a summary of the upgrade results.

This automation maintains subscriptions on every active employee’s meeting-recordings folder so that folder changes and newly generated meeting transcripts generate notifications automatically. It replaces recurring manual folder searches and subscription setup with a scheduled process that routes events to a secondary ingestion flow.

This automation examines every attachment in an incoming email for potential malware and evaluates each file through a security analysis service. When a malicious file is identified, it creates an incident issue, alerts the security team, and generates an analysis report; clean emails complete successfully.

This automation receives a domain from a webhook, adds it to a security blocklist, and reports whether the action succeeded or failed. It removes the need to manually update the blocklist and notify the appropriate security audience.

This automation manages device unlock requests from intake through approval, Jamf Pro command execution, and user communication. It replaces repeated account and device lookups with a controlled approval workflow that either queues the unlock or clearly communicates the decline.

This automation manages just-in-time access to sensitive cloud resources by translating an authorized Slack request into temporary account permissions. It grants the selected access for a defined period, automatically revokes it afterward, and keeps the requester and team informed through Slack.

This automation monitors Okta sign-in events, identifies repeated failed login attempts, and correlates them within a ten-minute window. When more than five failures are associated with a valid user, it sends an alert to the #security-alerts Slack channel.

This scheduled automation continuously checks for newly published vulnerabilities, validates affected network exposure, and records the findings in a structured report. When relevant matches are found, it sends the report link and vulnerability context to a designated team channel for follow-up.

This automation responds to suspicious Okta login activity detected by Panther by notifying a security channel and presenting an approve-or-revoke decision. When revocation is selected, it terminates the user's active sessions and retrieves the user's grants for access review.

This automation receives a username or email address, identifies the corresponding directory user, and retrieves that user's manager details. It returns the manager's display name and email when available, or records that the manager email could not be retrieved.

This automation analyzes the first attachment from an email forwarded to a dedicated email hook and determines whether it is malware. If malicious, it locates and deletes the related mailbox message, then alerts the recipient through Slack; otherwise, the flow ends after the analysis.

This automation runs a daily employee compliance review, checks each person against defined security and compliance requirements, and identifies specific failures. When non-compliant employees are found, it sends a clear alert with the failed checks to a Slack channel; otherwise, the run completes without sending a message.

This automation processes a dedicated command containing parent and child ticket IDs, validates the tickets, removes their parent-child relationship in ServiceNow, updates the tracking table, and confirms successful completion in the security channel. It replaces the repeated lookup, update, tracking, and notification work required to handle each request manually.

When a ServiceNow ticket is closed, this automation finds its child tickets and closes them in sequence, including cascading checks for additional descendants. It also sends a confirmation to the Security Teams and can update the related ticket status in an Excel table.

This automation reviews open pull requests and identifies those that have not been updated for approximately 30 days. It looks up the responsible user and sends a Slack alert, or routes the notification to the repository administrator when no user mapping is found.

This automation retrieves an email attachment from a user's mailbox, converts it for analysis, and checks whether it contains malware. Malicious attachments are deleted and the associated user is notified in Slack, while clean files complete successfully.

This automation responds to a command by retrieving tickets with RFC status and posting the resulting list into a chat. It replaces the need to search the ticket system, compile the results, and share them manually.

This automation responds to a suspected compromised Azure Active Directory password by updating the user's password and forcing a change at the next sign-in. It checks the update result, sends a confirmation email when successful, and routes unsuccessful changes to a failure outcome for security handling.

This automation turns supplied new-user details into an enabled Microsoft 365 account with department, title, and licensing configured, then creates a Jira issue and sends a Teams notification. It replaces the repeated account setup, licensing, ticket creation, recipient lookup, and notification steps with one connected workflow.

This automation runs scheduled searches for exposed IP camera web interfaces or servers within defined networks, then turns any matches into a structured report. It gives the responsible team a ready-to-review spreadsheet link in Slack for follow-up and remediation.

This automation handles user-reported suspicious Okta logins by terminating active sessions, enriching each source IP with reputation, threat, and location data, and alerting the relevant team in Slack. The team can then choose to add the IP to an Okta network block list or record the decision to ignore the event.

This automation monitors configured RSS feeds for articles published within the previous 24 hours, turns newly found content into a formatted HTML briefing, and delivers it by email. It replaces the recurring effort of checking feeds, selecting recent articles, formatting updates, and sending a notification.

This automation scans for domain-related breach findings, determines whether compromised accounts require remediation, updates affected directory users with a newly generated hashed password, and sends the breach details to a channel. If no breach is found, the workflow completes with a no-breach result.

This automation turns incoming alert data into a Jira ticket, calculates and records an alert level from priority, criticality, and severity, and routes high-level alerts for team attention before assigning them to the appropriate person. It replaces fragmented ticket creation, prioritization, notification, and assignment work with a consistent workflow.

This scheduled automation compares Eng-tagged computer inventory with the devices currently assigned to an application access list, then adds missing devices and removes outdated ones. It keeps conditional access authorizations aligned with the latest asset records and notifies the team of the changes.

This automation continuously prepares employee Exchange inboxes for email monitoring by renewing subscriptions for users with Office licenses. Each newly received email generates a webhook notification for a separate downstream flow that performs email analysis.

Bulk IP Location Reporting automatically looks up the geographic details of a manually supplied list of IP addresses, including country, city, and coordinates. It compiles the findings into map-ready records and delivers the completed investigation report by email and webhook.

This automation converts Google Forms submissions into Zendesk support tickets by looking up the requester, creating the ticket, and sending a confirmation email. It replaces the repeated handoff from form intake to ticket creation and notification with a consistent automated process.

This automation retrieves a configured public Pinterest page, extracts image URLs, sends the images for OCR analysis, and compiles the findings into a report. It then creates a support ticket and emails the analysis so an analyst can review and flag potentially malicious content.

This automation monitors recent Okta sign-in events and identifies users with more than four failed login attempts. It creates a PagerDuty alert, notifies the SOC in Slack, and lets an analyst acknowledge or close the alert from Slack.

This automation maintains a Microsoft Sentinel alert subscription on a recurring schedule so new security alerts are sent to a webhook without requiring someone to repeatedly check the Sentinel dashboard. It renews an existing subscription or creates a new one, helping preserve ongoing alert delivery within the subscription lifetime.

This automation performs a monthly inventory of applications installed on employees' devices, excludes Apple default applications, and records the remaining software details in a spreadsheet. It then notifies the relevant operations channel that the monitoring report is available for review or follow-up.

This automation monitors GitHub pull request events and routes relevant review requests, review results, and merge-queue failures to the right people in Slack. It resolves GitHub-to-Slack identities, distinguishes individual reviewers from teams, and delivers targeted channel announcements or direct messages.

This scheduled automation discovers the MX servers associated with a domain, checks each server's reputation and location, and compiles the findings into a report. The report is posted to a team communication channel so email infrastructure issues can be reviewed proactively.

This automation checks the email accounts of users in a domain against known data breaches and records the findings in a spreadsheet. It replaces repeated account-by-account searches and manual result entry with a centralized breach inventory.

This automation delivers a personalized cybersecurity awareness questionnaire, scores each response, records the results, and determines whether the participant passes. Successful participants receive a congratulatory message and an emailed certificate, while unsuccessful participants receive targeted follow-up guidance.

This workflow manages Google Workspace users and groups from Slack commands while checking whether the requester is authorized. It applies the requested suspension, unsuspension, or deletion and posts the result back to a designated Slack channel.

This automation monitors newly enrolled Jamf devices to verify that CrowdStrike recognizes them. It posts the enrollment status to a designated Slack channel, confirms successful detection, or alerts the IT team if the device remains undetected after approximately one hour.

This automation retrieves device users and installed applications, filters out Apple system bundles, and keeps per-user spreadsheet records current by adding new applications or updating changed versions. It then publishes a completion message with the application report and uninstall instructions.

This automation runs a configured Snowflake query, extracts IPv4 addresses, checks IP reputation through two threat-intelligence services, and records an asset-ownership note on a Zendesk ticket. It replaces the repeated handoff between data retrieval, reputation lookups, and ticket updates with one chained workflow.

This automation monitors HashiCorp Vault cluster replication health by retrieving the required Vault data, validating the status response, and evaluating primary and secondary health conditions. It sends targeted Slack notifications when problems are detected or when status updates need to be shared.

This automation prepares sent-email monitoring across active user mailboxes by retrieving domain users, generating the required authorization token for each user, and refreshing their mailbox watch. It stops existing watches and starts new watches limited to messages labeled as sent, routing notifications to the designated monitoring topic.

This automation finds open cases, groups them by owner, and prepares a personalized ticket summary for each person. It then routes the summary through an ephemeral Slack message when the owner is found or an email fallback when no Slack match exists.

Automates create, update, and delete requests for user accounts by parsing the requested action and email, checking whether the user exists, and applying the appropriate account change. It then sends a clear status message to the requested Slack channel, including when a user already exists or has already been deleted.

This automation turns each incoming email into a structured, actionable alert by extracting key message details and posting them to a configured channel. It gives recipients the context they need, along with direct options to open the playbook or respond to the sender.

This automation coordinates a recurring macOS update process by presenting available versions, identifying devices below the selected version, and requesting approval before launching the update. It replaces repeated Jamf and Slack handoffs with a guided workflow that keeps the responsible team informed at each stage.

This automation runs scheduled network exposure checks using predefined search queries, records both findings and clean results in a structured report, and alerts the security team when potential misconfigurations are detected. It replaces the manual scan-to-report process with a consistent, unattended monitoring cycle.

This automation selects one show from a predefined set, retrieves a matching quote, formats it with the speaker or character, and posts it to a configured Slack channel. It removes the need to manually search for, format, and share an entertaining TV quote.

This automation sends approval requests to Slack, captures whether a reviewer selects Approve or Deny, and posts the corresponding status update. It replaces manual follow-up and decision routing with an event-driven approval process.

This automation monitors Palo Alto security advisories, removes duplicate entries, and identifies advisories affecting Traps or GlobalProtect. It then sends the relevant customer notification and creates a Jira issue for GlobalProtect advisories.

This automation starts or stops the Test environment's EC2 instances according to configured weekday and working-hour windows, avoiding the need to keep development resources running outside scheduled usage. It verifies the resulting instance states and sends the outcome, including failures, to a team Slack channel.

This automation retrieves existing WordPress subscriber accounts across five paginated requests and adds each subscriber’s first name, last name, and email address to a spreadsheet. It replaces manual subscriber lookups and spreadsheet entry with a repeatable, email-triggered process.

This automation receives a request containing Chrome extension names, identifies their extension IDs, and adds them to a JAMF Pro Chrome blocklist configuration profile. It preserves the existing entries, updates the profile, and notifies a Slack channel when the change is complete.

This automation combines related endpoint malware and cloud access alerts, uses an AI-generated explanation to normalize what happened, and delivers the resulting summary to a team channel. It replaces separate alert review with a concise, human-readable incident narrative.

This automation monitors Google Drive upload events, analyzes uploaded files for malware, and automatically removes malicious files. It then alerts the security team with the file, uploader, analysis score, and remediation details.

This automation evaluates AWS environments against compliance standards by collecting WAF and VPC configuration details, identifying non-conforming environments, and compiling the findings into a report. The completed report is archived and delivered through the designated security channel.

This automation retrieves threats created during the previous day, gathers the relevant details, and consolidates them into a Jira investigation ticket. It replaces a recurring manual review and reporting process with a consistent threat summary for the security team.

This scheduled workflow monitors selected HubSpot users' login and security activity to identify anomalous behavior such as unusual locations, IP addresses, off-hours access, sensitive actions, or activity bursts. It consolidates confirmed suspicious findings into a Slack notification for analysts to review.

This automation performs a scheduled external attack surface assessment for a domain by enumerating subdomains, checking DNS and email security configuration, and examining publicly exposed infrastructure. It consolidates the findings into a structured markdown report with risk analysis, a TL;DR, and follow-up actions.

This automation searches an Office 365 mailbox for messages that meet the configured spam-processing criteria, removes matching messages, and records the result. It eliminates the need to manually review and delete qualifying messages one by one.

This automation scans a configured list of IP addresses for exposed ports, identifies the services and protocols associated with any findings, and posts a consolidated report to a Slack channel. It replaces repeated lookups and manual report assembly with a scheduled, repeatable port-visibility check.

This automation retrieves the CISA known exploited vulnerabilities feed, filters entries to a configured date range, and checks each CVE against vulnerability data in Tenable. When a matching vulnerability is found, it reports the finding to the security team in Microsoft Teams and creates a Jira issue for tracking.

This automation receives monthly macOS persistence scan results, associates each device with its employee, and organizes detected software, scripts, daemons, login items, and browser extensions into a structured report. It then notifies the responsible team with the report location so security oversight does not depend on manual scanning and data entry.

This workflow guides a user through selecting a vendor document type, locates the configured vendor, and uploads the corresponding compliance document to Drata. It then posts a completion notification in Slack so the upload status is visible without a separate follow-up.

This automation enriches submitted email addresses, domains or URLs, and attachments by comparing them with internal trusted and whitelisted reference lists. It returns a branch-specific assessment to the calling workflow, helping analysts identify trusted values and isolate URLs that are not on the approved list.

This scheduled automation retrieves the latest active malicious hostnames from a threat intelligence feed, formats them, and replaces the firewall's hostname blacklist with the refreshed set. It removes the need for analysts to download, extract, reformat, and apply blacklist updates manually.

This automation analyzes a submitted phishing email by extracting sender addresses, URLs, and attachments, then checking those artifacts against reputation and threat-intelligence services. It formats the findings into a consolidated report and delivers the results by email.

This automation scans a domain for known breaches, checks whether the scan completed successfully, and initiates remediation for affected accounts by generating new password hashes and updating user records. It then sends breach and remediation details to a designated team channel for visibility.

This automation retrieves issues from a security platform, collects the evidence associated with each issue, and sends the available evidence to Splunk as audit events. It replaces repeated issue-by-issue retrieval and forwarding with a controlled, evidence-aware ingestion process.

This automation regularly retrieves the latest Known Exploited Vulnerabilities catalog and stores it as a dated CSV file in SharePoint. It replaces recurring manual downloads and uploads with a scheduled update process, keeping the catalog available for vulnerability research and internal use.

This automation detects updates to monitored Google Meet recording folders, retrieves the relevant transcript or chat content, and generates a structured meeting summary with the title and attendee details. It then delivers the summary directly to each internal attendee through Slack, eliminating the need to prepare and distribute meeting notes manually.

This automation turns vulnerability and asset data into a structured exposure dashboard by expanding a configured tag hierarchy, querying vulnerability metrics across several dimensions, and writing the results into a prepared spreadsheet. It replaces repeated security-data lookups and spreadsheet updates with a consistent dashboard refresh.

This scheduled workflow establishes and refreshes mailbox monitoring for active users in a domain, so incoming inbox activity can generate push notifications for downstream email security analysis. It removes the need to configure and maintain each user mailbox watch manually.

This automation monitors incoming Okta sign-in events, identifies bursts of more than five failed login attempts within ten minutes, and validates the associated username before alerting a designated Slack channel. It helps security teams detect potentially suspicious login activity without manually reviewing, counting, and escalating each event.

This automation retrieves tracked objects from the MITRE ATT&CK framework through its TAXII service, identifies new activity, and posts a brief overview to a Slack channel. It replaces repeated collection review and message preparation with a consistent intelligence update.

This automation turns a user command containing a target web application URL into an on-demand PCI web application scan, then manages report generation and delivery automatically. It produces a PDF report in SharePoint and sends the file URL back to the requesting user.

This automation reviews roaming computers, identifies devices that are offline and have not synchronized for more than seven days, and emails a consolidated report to the designated agent. It replaces device-by-device checking with an automated exception report containing the affected device names, statuses, and versions.