Before
An analyst likely had to retrieve notable alerts, wait for the event data to become available, create and monitor a search, and repeatedly check whether it had completed. They then had to retrieve the results, update the notable status and comment manually, or notify an administrator when the search failed.
How it works
- Receive the notable alert and allow time for the event details to become available.
- Create the lookup search, poll its status until it completes or fails, and notify the administrator on failure.
- Retrieve the completed search results and update the notable event status with a comment.
Workflow details
- Alert intake: The workflow starts when an emailhook event is received, then retrieves notable alerts from the security monitoring environment.
- Search preparation: It waits 15 seconds to allow the notable event to be written to a lookup, then creates a search to retrieve the related notable event ID.
- Search monitoring: After a five-second wait, the workflow checks the search status and evaluates whether the search has completed, failed, or still requires additional time.
- Exception handling: If the search fails, an email is sent to the administrator. If the search is still running, the workflow waits another five seconds before checking again.
- Status update: When the search completes, the workflow retrieves the results in JSON format and proceeds to update the notable event status and add a comment.
What changed
The full search-and-update sequence now runs automatically after the alert is received. Search readiness, completion, failure handling, result retrieval, and the successful status update are handled in the workflow, while failed searches are routed to the administrator by email.
Work removed
Manually retrieving notable alerts, waiting for event data, creating searches, checking search status repeatedly, retrieving search results, updating notable statuses and comments, and emailing an administrator about failed searches.
Expected outcome
One automated search-and-update cycle per notable alert, removing at least five recurring analyst actions while preserving administrator notification for failed searches.
