Before
Analysts or SOC processes had to maintain separate routines for scheduled alert polling and incoming notifications. They also had to validate the intake, identify eligible incidents, retrieve details, claim each incident, and initiate the triage handoff manually or across separate steps.
How it works
- Identify whether the request is a scheduled poll or an incident notification, then validate the intake.
- Select unresolved alerts that match the configured rules and time window, or normalize the notified incident.
- Retrieve incident evidence, mark the incident as claimed, and start the downstream triage handoff.
Workflow details
- Intake: The workflow accepts either an incoming incident notification or a scheduled polling request. It identifies the source, validates that webhook notifications include an incident identifier, and rejects malformed notifications before investigation begins.
- Selection: Scheduled runs examine the defined alert rules within the polling window and retain unresolved incidents, while webhook runs normalize the notified incident into the same processing format.
- Investigation context: Each selected incident is opened to retrieve available evidence such as the user, source address, URL, host, country, user agent, device, and operation involved.
- Claiming: The workflow adds a visible comment to each incident stating that automated triage has started, helping prevent duplicate analyst handling.
- Handoff: Each incident, its retrieved rows, and its intake origin are sent to the downstream triage process asynchronously, creating a consistent starting point for investigation.
What changed
Scheduled and notification-based intake now use one processing path. Eligibility checks, incident detail retrieval, claim marking, and triage initiation happen automatically, while invalid notifications stop before investigation begins.
Work removed
Manually checking notification validity, reviewing alert rules and time windows, identifying unresolved incidents, opening incidents for supporting details, adding claim comments, and initiating the triage handoff one incident at a time.
Expected outcome
Each eligible incident receives a consistent automated triage handoff, with an estimated four or more recurring analyst touchpoints removed per incident; this estimate is based on the workflow steps rather than measured results.
