Before
Security personnel likely had to retrieve the alert details, create a tracking ticket, notify the security team, and wait for a response before taking the next action. They then had to manually escalate the issue, start a scan, or add the outcome back to the ticket.
How it works
- Capture the Microsoft Defender Cloud alert, retrieve its details, and create a Jira ticket.
- Notify the security team and use its response to select the appropriate handling path.
- Escalate through PagerDuty, initiate a SentinelOne scan, or add the resulting update to the Jira ticket.
Workflow details
- Alert intake: When a Microsoft Defender Cloud alert is received, the workflow retrieves the alert information and uses it to create a new Jira ticket, giving the security team a tracked record of the event.
- Security notification: After the ticket is created, the workflow sends a message to the security team with the information needed to review and respond to the alert.
- Response-based routing: The workflow evaluates the security team’s answer and routes the alert to the corresponding operational path rather than applying the same action to every event.
- Escalation or scanning: Depending on the response, the workflow either creates an incident in PagerDuty for escalation or initiates a scan in SentinelOne.
- Ticket updates: When a scan is initiated, the workflow posts the scan results to the Jira issue; other response paths can add a comment, keeping the alert’s handling history attached to the ticket.
What changed
Each alert now creates a tracked Jira issue and reaches the security team through an automated handoff. The team’s response determines the next operational action, while escalation, scanning, and ticket updates are performed and recorded automatically.
Work removed
Manually retrieving alert details, creating the Jira ticket, notifying the security team, routing the response, initiating the escalation or scan, and copying scan results or comments back into the ticket.
Expected outcome
At least three recurring manual handoffs per alert can be removed, with the alert response and resulting ticket update handled through one automated workflow.
