Before
A security analyst would likely search account connection history, Drive activity, breach records, IP reputation, and IP-location data separately across multiple tools. The analyst would then correlate the findings, write the assessment and recommendations, format the report, and notify the security team manually.
How it works
- Receive an employee investigation request and collect recent connection, IP, account-activity, and breach-related evidence.
- Enrich the IP addresses with location data, generate supporting reputation analysis, and use the collected results to produce a boolean risk assessment.
- Route the assessment to either a structured Slack security report or an all-clear notification, while validating the configured condition logic and test values before production use.
Workflow details
- Investigation intake: The flow begins with an employee investigation request, such as a SIEM alert, and uses a user email plus an IP-address list as investigation context. The configured example uses a fixed user email and sample IP addresses.
- Evidence collection: AI agents retrieve the user's three latest connection IP addresses, most recent connection time, and five latest Google Drive activities. The workflow also performs an email breach lookup, but the configured breach check uses a fixed test address rather than the investigation user's email.
- IP enrichment: Each IP address is sent through a location lookup to collect details such as city and country. A separate AI step is instructed to create an IP reputation report and add an assessment, but the JSON does not show a dedicated reputation-service request in that step.
- Risk assessment: An AI step combines breach results and IP-location data and returns a boolean risk assessment. The configured condition wiring appears reversed: the branch labeled "Yes!!!" sends the flow toward report generation when the result is false, while the alternate branch posts an all-clear message when the result is not false.
- Reporting and handoff: The report-generation step creates a Slack Block Kit security report covering IPs, connection time, reputation, location, two-factor status, breach history, Drive activity, overall assessment, and recommendations. Before delivery, a step named "Isolate endpoint" makes a data-retrieval request to a random-data service; the JSON does not evidence a confirmed endpoint-isolation action. The resulting report or all-clear message is then posted to the configured Slack channel.
What changed
Investigation evidence is now gathered and assembled into a repeatable report workflow instead of being collected and correlated manually across separate lookups. The final handoff is delivered directly to Slack, but the fixed test email, sample IP inputs, condition wiring, and endpoint-related step still require validation to ensure the automated outcome matches the intended risk decision.
Work removed
Manually reviewing recent connection events, retrieving the latest Drive activities, checking breach exposure, looking up IP locations, compiling IP reputation findings, correlating evidence, writing the assessment and recommendations, formatting the Slack report, and notifying the security team.
Expected outcome
Conservatively, each run can remove at least five distinct evidence-gathering tasks and the associated report handoff, producing a repeatable Slack-ready investigation package; risk accuracy depends on correcting or validating the configured test values and reversed-looking branch logic.
