Before
An analyst inspected generative AI activity and manually checked each observed application or domain against the approved list. The analyst then had to summarize exceptions, notify the security team, and open a case for follow-up.
How it works
- Collect the previous 24 hours of generative AI DNS activity and retrieve the approved AI application and domain list.
- Compare the observed activity with the allowlist and determine whether unapproved domains or applications are present.
- Consolidate any exceptions, notify the security team in Teams, and create one ServiceNow incident for the run.
Workflow details
- Trigger and collection: An on-demand webhook starts the workflow, which reads generative AI DNS activity for the previous 24 hours and retrieves the approved AI application and domain list.
- Automated validation: The workflow compares observed DNS records with the approved list and isolates distinct unapproved domains, including their request counts and associated identities.
- Exception decision: If no unapproved activity is found, the run completes without sending alerts or creating a ticket; otherwise, the detections are consolidated into a single summary.
- Notification and case creation: The summary is posted to a Teams channel and used to create a security-category ServiceNow incident with the detected domain details.
- Operational result: Each exception run produces one consolidated notification and one incident, giving security a consistent handoff for investigating unapproved generative AI usage.
What changed
The 24-hour review, allowlist comparison, exception decision, summary creation, notification, and ticket handoff now happen automatically. Clean runs end without an alert, while detected gaps generate one consolidated Teams message and one ServiceNow incident.
Work removed
Reviewing DNS activity one record at a time, cross-checking domains against the approved list, identifying associated users and request counts, compiling exception summaries, notifying the security team, and manually opening a ServiceNow incident.
Expected outcome
Consistent daily or on-demand coverage of generative AI domain exceptions, with one consolidated notification and one incident per run when unapproved activity is found.
