Before
An analyst opened the user’s account history, searched for failed or denied events within the relevant period, and matched those events to the reported behavior. The analyst then summarized the evidence and possible next steps for the support team.
How it works
- Receive the user context, reported behavior, and investigation time window.
- Retrieve the user’s failed or denied sign-in events and analyze them against defined incident causes and evidence rules.
- Return a structured assessment with proposed actions, risk, confidence, and any required human review.
Workflow details
- Trigger and context: The flow receives a username, the user’s reported sign-in behavior, and an incident start and end date from the calling workflow.
- Evidence collection: It retrieves failed or denied sign-in events for that user within the specified period, creating a focused evidence set instead of requiring a separate log search.
- Contextual analysis: An analysis agent reviews the events against the reported behavior and applies defined rules for issues such as invalid credentials, MFA failures, inactive accounts, or missing application access.
- Decision support: The agent identifies confirmed or possible causes, records evidence and missing information, assigns a risk and confidence level, and determines whether human review is required.
- Result delivery: The workflow returns the analysis as its output, including proposed actions where the evidence supports them; the flow proposes actions but does not execute account or access changes.
What changed
The relevant event search and initial evidence assessment now happen within the workflow, producing a consistent structured handoff for support. Human review remains required when evidence is incomplete, confidence is low, causes conflict, risk is high, or the analysis indicates that review is necessary.
Work removed
Opening account history, searching failure and denial events separately, filtering them by user and date range, matching events to the reported behavior, and manually assembling the first-pass investigation summary.
Expected outcome
At least one separate log-search and first-pass evidence-summarization step is removed from each investigation, giving support a consistent analysis to review.
