Before
Security or cloud operations teams would review each incident response, determine whether the issue involved a user, resource, or indicator, and choose the appropriate remediation path. They would then move between administrative tools to change passwords, disable users, block IPs, power off instances, delete instances, or check remediation status.
How it works
- Receive the incident response and identify whether the requested action concerns an identity, resource, or indicator.
- Evaluate the selected remediation type and automatic-execution preference before deciding whether to proceed.
- Apply the relevant password, account, IP, or instance remediation and complete the workflow.
Workflow details
- Incident intake: An email-triggered incident enters the workflow with the user or resource context, selected indicators, remediation preferences, and responses that guide the next decision.
- Target selection: The workflow evaluates whether the case concerns an identity, a cloud resource, or an indicator to block, then selects the relevant user, resource, or indicator set for remediation.
- Execution control: Conditional checks determine whether blocking or remediation should happen automatically. If automatic execution is not enabled, the flow can stop after evaluating the request rather than applying the action.
- Remediation routing: For identity cases, the workflow routes to password change or user disablement. For resource cases, it routes to instance power-off or deletion and checks the related cloud remediation state; for indicator cases, it routes selected indicators to IP-blocking actions.
- Completion: Each branch ends in a successful completion state after the selected action path is processed, or after the workflow determines that no applicable remediation should be performed.
What changed
Incident inputs are now routed through explicit identity, indicator, and resource decision paths, with automatic-execution checks performed before remediation. Human approval or response selection can still control whether action proceeds, while approved paths can carry out the configured remediation without a separate manual handoff.
Work removed
Reviewing incident responses individually, determining the remediation category, selecting users or resources, choosing the remediation type, checking whether automatic execution is permitted, manually initiating password changes or account disablement, blocking IPs, powering off or deleting instances, and checking resource remediation status.
Expected outcome
For each qualifying incident configured for automatic execution, the workflow can conservatively remove at least one manual remediation handoff while consistently applying the selected response path.
