Before
An administrator would likely review active users, retrieve IP history from a spreadsheet, and compare multiple addresses one user at a time. They would then check IP reputation, compare network and location changes, calculate travel distance, notify the team, and decide whether to lock the device.
How it works
- Retrieve active users and spreadsheet-based IP history, then identify users with more than one distinct address.
- Check each IP for malicious findings and compare subnet membership; when addresses differ, review recent locations and calculate the distance between them.
- Post the relevant evidence to the team channel and provide or initiate device-lock containment for suspicious cases.
Workflow details
- User and IP collection: An email event starts the workflow, which retrieves active users from a specified organizational unit and processes them individually. Spreadsheet data is then read to obtain the recorded IP addresses associated with each user.
- IP history analysis: The workflow extracts, sorts, and deduplicates the IP values, continuing only when more than one distinct address is present. Each distinct IP is checked for malicious findings using an external reputation analysis service.
- Network and location validation: When an IP is flagged by the reputation check, the workflow evaluates whether the addresses belong to the same subnet. If they do not, it retrieves the last two recorded locations and calculates the distance between them to identify changes that may be difficult to explain geographically.
- Automated decision-making: The workflow uses the reputation result, subnet comparison, and distance evaluation to distinguish ordinary network changes from potentially suspicious activity. A distance of approximately 25 kilometers or less is treated as close enough by the configured condition.
- Alerting and containment: Suspicious findings are posted to a team channel with the user, IP addresses, reputation score, network status, and location-distance context. The workflow also provides approval and device-lock actions and can submit a device-lock command through the device-management system on the containment path.
What changed
IP, reputation, network, and location checks now run as one user-by-user workflow before the result is delivered to the team channel. Analysts receive the comparison evidence in the alert and only need to make the remaining approval or containment decision where the workflow presents one.
Work removed
Manually listing active users, pulling spreadsheet IP values, reviewing users with multiple addresses, checking IP reputation, comparing subnets, retrieving recent locations, calculating travel distance, composing security notifications, and submitting device-lock commands.
Expected outcome
For each user with multiple recorded IPs, one recurring manual IP-review and alert-preparation cycle is replaced by automated checks; measured time savings or incident-reduction results are not specified.
