Before
Security personnel likely had to review file-visibility events, inspect the document title and ownership details, and compare the title against sensitive-content indicators manually. They then had to notify the team, change the file permission when necessary, and record or close the case across separate systems.
How it works
- Monitor file-visibility events and identify documents whose sharing changes to people with the link.
- Extract the document and event details, scan the title for sensitive or business-critical terms, and route relevant findings to the Security team in Slack.
- Let the responder choose whether to reset the file to private or close the alert, then record the outcome and update the Slack case.
Workflow details
- Monitor visibility changes: The workflow starts when an event is received and filters for document visibility changes involving files shared with anyone who has the link.
- Inspect document context: It extracts the document title, owner, actor, new visibility, access scope, and document identifier, then breaks the title into words for comparison against a list containing terms such as Confidential, Classified, Restricted, Sensitive, Internal, NDA, Contract, Invoice, and other protected-document indicators.
- Route the security alert: When the title check produces a relevant result, the workflow sends the Security team a Slack alert containing the actor, document title, owner, visibility, and access scope, along with options to reset visibility or close the alert.
- Apply the selected response: If the reset action is selected, the workflow generates the required access authorization and removes the public link permission so the file's visibility is reverted to private. If the alert is closed instead, it follows the closure path without performing the reset.
- Document resolution: The workflow creates an Airtable record describing the case and remediation status, then updates the Slack message to mark the alert as resolved or archived with the applicable action details.
What changed
Visibility-change events are now filtered and enriched automatically before reaching Security. The title-based relevance check, Slack alert content, permission-reset action, tracking record, and resolution update are prepared or executed by the workflow, while the responder retains the decision to reset the file or close the alert.
Work removed
Reviewing each visibility event individually, extracting the actor, owner, title, and sharing details, scanning document titles against the sensitive-term list, composing the Security notification, manually removing the public link permission when reset is selected, and entering the case outcome in the tracking record.
Expected outcome
Each qualifying visibility change receives a consistent automated review and documented Slack handoff, with the option to restore private visibility and log the resolution without requiring separate manual searches and record updates.
