Before
Security analysts likely reviewed downloaded-file alerts individually, looked up the affected user and device, and opened separate tools to retrieve and investigate the file. They also had to compare hashes, submit unknown files for analysis, search for related cases, format the findings, and notify the SOC before deciding on remediation.
How it works
- Receive a downloaded-file event, identify the file and endpoint, and enrich the alert with the affected user and device details.
- Retrieve the file through a remote response session, check its hash, perform deeper analysis when needed, query malware intelligence, and extract investigation indicators.
- Format the findings, correlate them with open Jira issues, and send a Teams alert with links for analyst-approved ticketing, URL blacklisting, endpoint deletion, or sandbox analysis.
Workflow details
- Trigger and context: The workflow starts when a monitored-folder change event is received for a covered host, typically indicating that a file was downloaded from an unknown source. It extracts the filename, download source, host, severity, timestamp, and related event information.
- Endpoint and identity enrichment: The workflow retrieves the affected device and user details, starts a remote response session on the host, and requests the downloaded file. It waits for the command to complete before continuing with the file analysis.
- Threat intelligence analysis: The file hash is checked against VirusTotal. If the file is not already known, the workflow uploads the file for deeper analysis, polls until the analysis is complete, and also searches MalwareBazaar for additional malware intelligence.
- Investigation and correlation: An analysis agent formats the alert into a structured security description, while the workflow extracts indicators such as IP addresses and file paths and searches for related open or in-progress Jira issues using the investigation context.
- SOC notification and response: The curated findings are sent to Teams in a security card containing host, operating system, user, severity, analysis results, related Jira issues, and download-source details. The card provides analyst-controlled links to create a Jira ticket, blacklist the download URL, delete the file from the endpoint, or submit it for sandbox analysis.
What changed
Each qualifying downloaded-file event is automatically enriched and investigated before the result reaches the SOC. Hash checks, file retrieval, deeper analysis decisions, malware-intelligence searches, indicator extraction, and Jira correlation happen in the workflow, while analysts retain control over ticket creation, URL blacklisting, endpoint deletion, and sandbox submission through the Teams alert.
Work removed
Reviewing downloaded-file alerts one by one, looking up user and device details, initiating remote response sessions, retrieving files, checking hashes across intelligence sources, polling analysis results, extracting indicators, searching related Jira issues, formatting findings, and manually assembling the SOC notification.
Expected outcome
The workflow can conservatively remove roughly 6–8 recurring analyst actions per downloaded-file alert while providing a consistent investigation summary and response handoff in one Teams notification.
