Before
Security personnel likely searched for severe Falco alerts in the SIEM, opened each event, and looked up the logs that triggered it. They then copied the relevant information into separate Jira Bug issues, repeating the process for every alert.
How it works
- Search Logz.io for configured severe Falco security events within the specified time range.
- For each event, retrieve the logs associated with the alert.
- Create a Jira Bug issue containing the event-related information for follow-up.
Workflow details
- Event search: The workflow searches Logz.io for security events matching the Falco search term and severe severity within the configured time range, returning up to 25 events sorted by severity and date.
- Evidence retrieval: It processes each returned event individually and looks up the logs associated with that specific security event, retrieving up to 10 matching log records.
- Ticket preparation: The workflow uses the event-related log information to prepare an issue for the corresponding security alert.
- Jira handoff: For every processed event, it creates a Bug issue in the configured Jira project, providing a repeatable destination for security-event follow-up.
- Operational result: Security teams receive one Jira issue per returned event instead of having to search for supporting logs and create tickets manually.
What changed
The event search, supporting-log lookup, and Jira ticket creation now happen as one automated workflow. Each returned security event is routed into a Jira Bug issue, reducing the handoffs required before a team can begin follow-up.
Work removed
Manually searching for severe Falco events, looking up the logs behind each alert, copying alert information, and creating a separate Jira Bug issue for every event.
Expected outcome
One Jira issue is produced per returned security event, with at least two manual lookup actions removed per event: finding the alert and retrieving its supporting logs.
