Before
Analysts likely reviewed each incoming alert, determined its source, and manually copied host IPs, usernames, or file hashes into the appropriate exclusion or allowed list. They also had to decide whether to close the alert as a false positive or hand off cases requiring a manual exception.
How it works
- Receive the alert and classify it by source, including analytics, firewall, AWS IAM, or XDR agent origin.
- Apply the matching host, username, file-hash exclusion, allowed-list update, or manual exception path based on the configured decision.
- Close the alert as a false positive when automatic closure is approved; otherwise, complete the workflow without closing it automatically.
Workflow details
- Alert intake: The workflow starts when a security alert is received through an email trigger and evaluates the alert source to determine which handling path applies.
- Source-specific exclusions: Analytics-originated alerts are checked further by origin. Firewall alerts result in the host IP being added to an alert exclusion list, while AWS IAM alerts add both the host IP and username. Other alerts on this branch add the file SHA-256 value to the exclusion list.
- XDR handling: Alerts identified as coming from an XDR agent are evaluated to determine whether the file should be allowed automatically or handled as a manual alert exception. Automatic approval adds the file hash to an allowed list, while the manual branch creates an alert exception for human handling.
- Closure decision: After an exclusion is added, the workflow checks whether the alert should be closed automatically. When approved, it closes the alert as a false positive; otherwise, the workflow completes without automatic closure.
- Operational result: Source-based routing standardizes how known false positives are recorded and separates automatically safe actions from cases that still require analyst review.
What changed
Alerts now receive source-specific routing and the corresponding exclusion or allowed-list update automatically. Automatic closure is handled by a separate decision, while cases marked for manual exception remain with a human instead of being closed or approved automatically.
Work removed
Reviewing each alert source, copying host IPs, usernames, and file hashes into exclusion or allowed lists, deciding whether an eligible alert should be closed, and manually creating standard alert exceptions for automated branches.
Expected outcome
Eligible automated branches can remove approximately 2–3 recurring analyst actions per alert, while manual exception cases continue to require human review.
