Before
An analyst would likely retrieve each alert, create or update a Jira issue, copy relevant alert details, and notify the responsible team member manually. Running scans, checking their status, collecting investigation evidence, escalating to on-call staff, or marking false positives would require repeated handoffs between security tools, Jira, Teams, and incident management.
How it works
- Retrieve the security alert, expand the alert data, create a Jira issue, and send a Teams card with the incident context and response choices.
- Apply the selected response path by starting and checking a quick scan, isolating the system, escalating the alert, or preparing a false-positive transition.
- Collect and download investigation evidence when required, add scan or isolation details to Jira, and continue the selected escalation or documentation path.
Workflow details
- Alert intake and tracking: The workflow retrieves security alert details, expands alerts for individual processing, and creates a corresponding Jira issue so the alert has a documented operational record.
- Team notification and decisioning: It identifies a team member, opens a direct Teams conversation, and sends a security alert card containing the Jira reference, severity, tactics, incident number, and available response actions. The recipient can choose to run a scan, isolate the system, escalate the incident, or mark it as a false positive.
- Automated investigation: When a scan is selected, the workflow starts a quick antivirus scan, waits for the result, and checks whether the scan succeeded. It then requests an investigation package, waits for collection to complete, retrieves the package, and adds the scan and investigation information to Jira.
- Containment and documentation: When isolation is selected, the workflow initiates full system isolation and adds the isolation status, requestor, comment, command line, and timestamp to the Jira record. It also includes a subsequent action to remove the isolation after the documented response path.
- Escalation and closure paths: An escalation choice creates a high-urgency incident for on-call response, while a false-positive choice retrieves Jira transition information so the alert can be moved through the appropriate Jira workflow.
What changed
Each alert now receives a Jira record and a Teams-based response decision without requiring separate manual handoffs. Scan completion, investigation-package collection, evidence delivery, isolation documentation, and escalation routing are handled automatically, while the human decision is limited to selecting the appropriate response option.
Work removed
Reviewing alerts one by one, creating Jira records, copying alert and scan details, manually notifying users, starting and polling antivirus scans, requesting and downloading investigation packages, adding evidence to Jira, and manually initiating escalation or false-positive processing.
Expected outcome
The workflow should provide a consistent, documented response path for each alert and manage up to roughly eight minutes of built-in scan and investigation waiting automatically per scan-and-investigation branch; this is a workflow-based estimate, not a measured customer result.
