Before
Security staff likely had to run the domain breach search manually, inspect the results, identify affected accounts, and switch to directory administration to remediate them. They then had to compile the breach name, date, description, and compromised data details before notifying a channel, while recording no-breach outcomes separately.
How it works
- Run the domain breach scan and evaluate whether breach findings are present.
- Extract the relevant breach details and, when affected accounts are identified, generate new hashed password values and update the corresponding user records.
- Post the breach and remediation details to a channel, or complete the workflow with a no-breach result.
Workflow details
- Breach scan: The workflow runs a domain breach scan against the breach-monitoring service and retrieves available breach information for evaluation.
- Finding validation: It checks the scan result to determine whether breach findings are present. A no-finding result completes the workflow without account remediation.
- Breach analysis: When findings exist, the workflow extracts the breach name, date, description, and categories of compromised data so the incident can be documented clearly.
- Account remediation: The workflow iterates through the identified breached accounts, generates a new password value using SHA-512 hashing, and updates the corresponding user records in the administrative directory.
- Notification: After remediation, it posts a structured message to a channel containing the breach details and the compromised data categories, giving the team a centralized operational update.
What changed
Each scan now performs the breach check, account remediation, and notification handoff automatically. Human operators receive the structured result in a channel instead of coordinating the search, directory updates, and incident summary themselves.
Work removed
Manually checking domain breach results, extracting breach dates, names, descriptions, and compromised data, reviewing affected accounts one by one, generating replacement password values, updating directory users, and composing channel notifications.
Expected outcome
Each detected breach automates at least three recurring actions—finding review, affected-account updates, and team notification—while no-breach scans complete consistently without manual follow-up; measured time savings are not provided.
