Before
Security responders likely had to collect the affected user's profile and recent sign-ins manually, compare activity from the same IP address, and look up network details across separate tools. They then had to coordinate the remediation decision, apply the chosen account or IP action, notify the team, and document the response in an incident ticket.
How it works
- Receive the brute-force alert and automatically gather the affected user's identity, recent sign-in history, related accounts using the same IP, and IP network context.
- Post the investigation summary to Slack and wait for an authorized responder to approve account locking, IP blocking, password reset, or alert closure.
- Execute the selected action, capture the responder and timestamps, create an incident ticket when remediation is performed, and update the Slack thread with the audit trail.
Workflow details
- Alert intake: A Datadog webhook starts the workflow when a brute-force alert is detected, carrying the affected account, failed-attempt count, event name, and source IP details.
- Investigation and enrichment: The workflow retrieves the user's profile and sign-in events from the last 24 hours, isolates events belonging to the affected user, identifies other accounts associated with the same IP address, and retrieves network information for the source IP.
- Analyst review: The investigation results are posted to a Slack channel with the relevant context and four response choices: lock the account, block the suspicious IP range, reset the user's password, or close the event. A human responder approves the next step through the notification.
- Guided remediation: Based on the approved choice, the workflow disables the user account, adds the suspicious IP range to the existing named-location blocklist, resets the user's password, or closes the alert without remediation.
- Audit and handoff: The workflow records investigation and remediation timestamps, identifies the responder, creates an incident ticket for remediation paths, and replies in the alert thread with the action history and a link to the ticket for review.
What changed
Each alert now initiates a standardized investigation and presents the evidence and response choices in one team notification. Human approval remains required for the selected remediation, while the workflow performs the approved action, records what happened, and completes the ticket handoff automatically.
Work removed
Manually retrieving user and sign-in details, searching for other accounts tied to the source IP, looking up the IP range, assembling the investigation message, applying the selected remediation, recording action timestamps, and creating or updating the incident ticket.
Expected outcome
A consistently documented, approval-driven response path for each brute-force alert, with investigation context, remediation timestamps, and incident records produced without repeated manual tool switching.
