Before
A team member likely had to monitor the advisory source, review recent entries, and remove duplicates manually. They then had to determine the affected product, copy the advisory date, title, and link into an email, and separately create a Jira issue for GlobalProtect items.
How it works
- Retrieve and prepare recent Palo Alto advisories from the incoming email-triggered workflow.
- Expand and deduplicate the advisory records, then classify each one as relevant to Traps or GlobalProtect.
- Send the matching customer email and, for GlobalProtect advisories, submit a Jira issue for operational follow-up.
Workflow details
- Advisory collection: An email-triggered workflow retrieves Palo Alto advisory data through Advanced Threat Prevention and prepares the recent advisory records for processing.
- Data preparation: The workflow expands the advisory results into individual records and removes duplicates before any notification or issue-creation action occurs.
- Product classification: Each advisory is evaluated against product-specific conditions to determine whether it relates to Traps or GlobalProtect.
- Customer communication: Traps advisories are formatted with the release date, title, and link and sent to the configured customer email recipient. GlobalProtect advisories receive the same type of customer notification with GlobalProtect-specific messaging.
- Operational handoff: When an advisory matches the GlobalProtect condition, the workflow also sends a request to create an issue in the configured Jira environment, giving the operations team a trackable follow-up item.
What changed
Advisories are now collected, deduplicated, classified, and routed automatically after the trigger event. Customer notifications are generated with the advisory date, title, and link, while GlobalProtect items also receive a Jira handoff without requiring separate manual preparation.
Work removed
Monitoring the advisory source, reviewing entries individually, removing duplicates, identifying the affected product, copying advisory details into customer emails, sending product-specific notifications, and manually submitting GlobalProtect follow-up issues to Jira.
Expected outcome
Each triggered batch of nonduplicate Traps or GlobalProtect advisories can be distributed and handed off through the configured channels without the recurring manual review and message preparation.
