Before
An analyst would likely run the Snowflake query, extract IPv4 addresses from the result, and move between separate reputation-checking tools. They would then manually add the configured ownership note to the relevant Zendesk ticket.
How it works
- Run the configured Snowflake query and prepare its results for processing.
- Extract IPv4 addresses and execute the configured AbuseIPDB and VirusTotal reputation lookups.
- Update the Zendesk ticket with the asset-ownership comment after the lookups are completed.
Workflow details
- Query execution: The workflow submits a predefined SQL statement to Snowflake using the configured database, schema, warehouse, role, timeout, and binding values, creating the data set for the remaining steps.
- IP extraction: The query result is processed to extract IPv4 addresses while excluding local IPv4 addresses. The extracted values are prepared for the following reputation-enrichment stage.
- Reputation checks: The workflow calls AbuseIPDB to check the configured IP address reputation and requests an IP report from VirusTotal. These checks are performed automatically as part of the same execution rather than requiring separate analyst lookups.
- Ticket update: After the reputation requests, the workflow sends an update to the configured Zendesk ticket containing the statement that the asset owner is Joe Bloggs.
- Operational boundaries: The flow does not show a threshold-based decision, branching rule, or human approval step. Its visible outcome is the completion of the configured lookups and the addition of the ownership comment to the ticket.
What changed
The query, IP extraction, reputation requests, and ticket comment now run as one connected sequence. The workflow retrieves the configured reputation information automatically, but no automated severity decision or approval step is shown before the ticket update.
Work removed
Running the configured Snowflake query, extracting IPv4 addresses, initiating separate IP reputation lookups, and copying the configured ownership note into the Zendesk ticket.
Expected outcome
The workflow can remove up to five recurring manual actions per run by combining query execution, IP preparation, two reputation lookups, and the ticket update in one sequence.
