Before
Security analysts likely had to monitor Google Drive upload events, inspect file details, obtain access, export or retrieve files, and submit them for malware analysis. When a threat was found, they also had to delete the file and manually notify the security team with the investigation details.
How it works
- Receive and triage each Google Drive upload event, then collect the file and uploader details.
- Prepare the file, submit it for malware analysis, and poll until the analysis is complete.
- If malware is detected, permanently delete the file and notify the security team with the result and remediation details.
Workflow details
- Event intake and triage: A webhook receives Google Pub/Sub notifications when files are uploaded to monitored Google Drive resources. The workflow filters for relevant watch events and extracts the file identifier, title, type, uploader, source IP address, destination folder, and upload time.
- File preparation: The workflow retrieves the uploaded file's metadata, obtains the required authorization token, determines the appropriate export format, and exports Google Workspace documents into a format suitable for binary inspection.
- Malware analysis: The prepared file is submitted for malware analysis. The workflow repeatedly checks the analysis result until processing is complete, then captures whether the file is malicious, its file type, and its analysis score.
- Automated remediation: When the completed analysis identifies malware, the workflow permanently deletes the file from Google Drive. Files that are not identified as malware proceed without deletion.
- Security notification: After a malicious file is removed, the workflow posts a detailed alert to a configured Slack channel, including the uploader, file name, file type, upload time, deletion time, and malware score.
What changed
Every relevant upload is automatically triaged and analyzed without waiting for an analyst to initiate the investigation. The malware decision, permanent deletion, and Slack handoff now occur as part of the same workflow, while non-malicious files complete without remediation.
Work removed
Monitoring upload events one by one, retrieving file metadata, obtaining access credentials, exporting files into an analyzable format, submitting files for analysis, repeatedly checking analysis status, deleting malicious files, and copying incident details into a team notification.
Expected outcome
The workflow can remove at least five recurring manual touchpoints for each flagged upload, while providing a consistent automated deletion and security notification process; no measured customer performance result is specified.
