Before
Analysts received Lacework alerts, determined manually whether they represented compliance violations, and investigated each issue across AWS services. They then applied the appropriate fix, copied alert details into Jira, and wrote remediation notes by hand.
How it works
- Receive the Lacework alert, retrieve its details, and confirm whether it is a compliance event.
- Create a Jira incident and route the alert according to its type, applying the corresponding cloud remediation.
- Add the remediation process to the Jira ticket so the incident includes a documented audit trail.
Workflow details
- Alert intake and validation: A Lacework webhook starts the workflow, which retrieves the alert details and checks whether the event is classified as a compliance alert before continuing.
- Ticket creation: For qualifying alerts, the workflow creates a Jira issue containing the alert name, type, date, and supporting context so the incident is formally recorded.
- Remediation routing: The workflow evaluates the alert type and sends it through the relevant remediation path, including S3 protection or versioning changes, encryption-related actions, IAM credential handling, or container vulnerability scanning.
- Audit trail updates: After each remediation path, the workflow adds a comment to the Jira issue describing the process flow and action performed, keeping the response history with the incident.
- Operational result: SOC analysts receive a documented incident and remediation record instead of having to investigate the alert, navigate multiple AWS services, apply the fix, and update Jira manually.
What changed
Compliance alerts now initiate a standardized remediation path automatically, with the relevant cloud checks and actions performed before the incident record is updated. Analysts receive a pre-populated Jira ticket with the remediation history rather than creating and documenting the response from scratch.
Work removed
Manual alert-by-alert compliance checks, AWS console navigation, applying recurring S3, IAM, encryption, or scanning actions, copying alert information into Jira, and writing remediation comments after each fix.
Expected outcome
An estimated 5–10 recurring manual actions are removed per alert, while each automated remediation is recorded in Jira for review and compliance tracking.
