Before
Security staff would likely calculate the reporting period, search for recently created threats, and review the returned records individually. They would then copy threat details into a summary and create a Jira issue for follow-up, introducing repeated lookup and handoff steps.
How it works
- Calculate the previous-day reporting window and retrieve up to 10 threats created during that period.
- Check whether threats are available and collect the key identifying and investigation details for each result.
- Assemble the findings into a dated summary and create a Jira investigation issue for the security team.
Workflow details
- Time-window preparation: Each playbook run calculates the previous day's start time and uses it as the reporting boundary for threat retrieval. The flow can support a scheduled daily report or an on-demand execution.
- Threat retrieval and validation: The workflow queries SentinelOne for threats created since the calculated start time, orders the results by creation date, and retrieves up to 10 records. A decision stage checks whether threats are available before continuing with the investigation report.
- Threat detail collection: For each returned threat, the flow prepares key investigation information, including the creation date, threat name, file content hash, agent identifier, and file path.
- Report preparation: The workflow transforms the collected information into a structured ticket description containing the reporting period, threat count, and threat details.
- Ticket handoff: A Jira issue is created with a title identifying the reporting start time and a description containing the consolidated threat report, giving the team a centralized investigation record.
What changed
Threat retrieval, presence checking, detail collection, counting, and report formatting now happen within one playbook run. The investigation handoff is delivered as a Jira issue with the reporting period and consolidated threat information instead of requiring a person to build the report manually.
Work removed
Calculating the daily search window, querying recent threats, reviewing each returned record, copying threat names and investigation fields, counting the results, assembling the report text, and creating the Jira issue.
Expected outcome
Each run can consolidate up to 10 recent threats into one Jira investigation issue, removing one recurring manual report-building and ticket-creation cycle.
