Before
Security analysts likely had to monitor Google Drive upload events manually, inspect file details and locations, and determine whether each upload required action. They then had to switch between administrative tools and team messaging, contact the employee for justification, coordinate deletion, and manually record the case status.
How it works
- Receive each upload event, extract its file information, and filter it by event type, monitored file type, and drive location.
- Retrieve the relevant file and owner details, then notify the responsible team with interactive options to ask the employee, close the case, or delete the file.
- Execute the selected response, including employee follow-up and deletion when requested, while updating the case with timestamps and its final cleared or remediated status.
Workflow details
- Event intake and filtering: A webhook receives upload events from Google Drive monitoring and extracts the file type, name, identifier, owner, location, and event time. The workflow first ignores unrelated event types and filters uploads according to the configured monitored file-type list.
- File investigation: For uploads that remain in scope, the workflow determines whether the file is in a team drive or an employee’s personal drive, retrieves the file details, calculates its size, and identifies the responsible employee.
- Security notification: The workflow posts a detailed alert to the responsible team in Slack with the uploader, file type, size, name, location, and time. The alert includes actions to ask the employee for an explanation, close the case, or delete the file.
- Employee follow-up: If the team asks for justification, the workflow contacts the employee directly, waits for a written response, forwards that response to the responsible team, and updates the case message to show that the investigation is ongoing.
- Remediation and closure: Based on the team’s subsequent decision, the workflow deletes the file when requested, warns the employee, records the deletion time, and updates the alert, or closes the event with a cleared status when no deletion is required.
What changed
Every monitored upload now arrives as a structured, actionable Slack case with file and owner context already attached. The workflow performs the configured checks, preserves the investigation thread through employee follow-up, and carries out the selected deletion or closure path while keeping the status and timestamps current; the team retains the decision to ask, close, or delete.
Work removed
Repeatedly reviewing upload events, retrieving file metadata and location details, identifying the uploader, calculating file size, composing team alerts, contacting employees for explanations, coordinating file deletion, warning employees, and manually updating case statuses and timestamps.
Expected outcome
Each handled upload can conservatively remove roughly 3 to 5 recurring manual actions, while providing a consistent notification, decision trail, and remediation outcome.
