Before
Security teams likely had to search for recent external findings, review results for duplicates and dangerous ports, and copy relevant details into separate notification, logging, and issue-tracking tools. Critical exposures depended on someone recognizing the port risk and creating the Jira handoff manually.
How it works
- Collect and search for host findings, then check whether results fall within the relevant 24-hour period.
- Deduplicate qualifying hits and distribute them to Slack and Splunk for notification and audit tracking.
- Check for configured dangerous ports and automatically create a Jira issue when the exposure meets that criticality condition.
Workflow details
- Scheduled Finding Collection: An incoming emailhook event initiates the workflow, which is described as running daily after publication to evaluate findings from the previous 24 hours. The flow retrieves host information and performs a hostname-focused search for externally visible findings.
- Recency and Deduplication Checks: The workflow evaluates whether results were found during the relevant 24-hour period and deduplicates matching hits before sending notifications, helping prevent repeated handling of the same finding.
- Security Team Notification: Qualifying findings are posted to a Slack channel using a rich notification and are also forwarded to Splunk as audit log data, giving the team both an operational alert and a searchable record.
- Dangerous Port Assessment: A separate condition checks whether the finding matches the configured dangerous-port criteria. The note indicates that this list can be adjusted to include more or fewer ports according to the organization’s definition of critical exposure.
- Immediate Issue Creation: Findings that meet the dangerous-port condition result in a Jira issue, creating a direct remediation handoff while less critical findings remain available through the notification and logging path.
What changed
Findings are now collected and screened through the same automated path before being routed to the appropriate destinations. The workflow handles recency, deduplication, notification, logging, and dangerous-port escalation automatically, leaving the team to investigate and remediate the resulting Jira issues.
Work removed
Repeatedly searching for recent hostname findings, reviewing results one by one for duplicates, checking ports against dangerous-port criteria, copying finding details into Slack and Splunk, and manually creating Jira issues for critical port exposures.
Expected outcome
Expected outcome is consistent daily coverage of recent findings, with duplicate alerts filtered and dangerous-port exposures automatically converted into Jira remediation work without manual triage or cross-tool copying.
