Before
An analyst would likely copy the submitted URL or domain into the security blocklist, check whether the update succeeded, and compose a status message. They would then need to identify the right recipient and post the result to a user or shared channel.
How it works
- Receive the webhook URL and extract its domain.
- Submit the domain for blocklisting and branch on whether the operation succeeds.
- Send the success or failure result to a configured user or the full notification channel.
Workflow details
- Webhook intake and domain extraction: The workflow starts when another system sends a webhook containing a URL. It extracts the domain from the submitted value so the security action can be applied to the relevant domain.
- Blocklist update: The extracted domain is submitted to the security platform's advanced security configuration for blocklisting. The workflow then evaluates whether the blocklist operation succeeded.
- Success or failure decision: Based on the result of the blocklist request, the workflow prepares a corresponding message that identifies the domain and states whether it was successfully blocked or could not be blocked.
- Recipient selection: If a preconfigured notification user is available, the workflow looks up that person's messaging identity and sends an ephemeral message to that user in the configured channel. If no specific user is selected, it sends the notification to the entire configured channel.
- Operational handoff: Each webhook execution produces a security action and a status notification, giving the relevant recipient immediate visibility into the outcome without requiring a separate manual update.
What changed
The domain-blocking request and outcome check now happen automatically from a webhook trigger. The resulting status is routed automatically either to a configured user or to the entire configured channel, replacing a manual security update and notification handoff.
Work removed
Copying the submitted URL or domain into the blocklist, checking the blocklist operation result, composing the success or failure message, looking up a specific recipient, and manually posting the notification.
Expected outcome
Estimated to remove up to five recurring manual actions per domain request while consistently producing a blocklist status notification.
