Before
An analyst reviewed the cloud application report and manually checked each AI-related application against the approved application list. When an exception was found, the analyst had to prepare a summary, notify the security team, and create a case separately.
How it works
- Retrieve the approved application list and the previous 24 hours of cloud application activity.
- Filter for AI-related applications and compare their names with the approved list, recording relevant usage and risk details for exceptions.
- If exceptions are found, send one consolidated Teams notification and create one ServiceNow incident; otherwise, complete with nothing to report.
Workflow details
- Trigger and collection: An on-demand webhook starts the workflow, which reads the approved AI application list and retrieves the cloud applications viewed during the previous 24 hours.
- Normalization and comparison: The usage report is converted into structured data, filtered for AI and machine-learning applications, and compared with the approved application names. For each unmatched application, the workflow captures its category, user count, upload volume, and risk index.
- Exception decision: If no unapproved AI applications are found, the workflow completes without sending alerts. If exceptions exist, it groups them into one readable summary for the current run.
- Notification and case creation: The summary is posted to the security team in Teams, and a security ServiceNow incident is created with the same detection details so the exceptions can be reviewed and handled.
What changed
The allowlist comparison and exception summary now happen automatically for each run. Only detected gaps enter the notification and incident path, creating a consistent handoff to the security team while no-finding runs close without unnecessary alerts.
Work removed
Downloading and reviewing the cloud application report, checking each AI application against the approved list, compiling exception details, posting the security notification, and creating the corresponding ServiceNow incident.
Expected outcome
Each exception-bearing run removes at least one manual allowlist review and two follow-up handoff actions: posting the notification and opening the incident.
