Before
Administrators likely had to repeatedly review whether monitoring channels were still active, stop existing channels to avoid duplicates, and recreate watches for each event type. They also had to maintain the handoff from cloud activity events to the workflows responsible for analysis and response.
How it works
- On each scheduled run, stop the existing monitoring channels for the configured login, download, and access-change resources.
- Create fresh webhook watches for successful user logins, Drive downloads, and shared-drive permission changes.
- Leave the resources continuously monitored so each event can launch a separate workflow for analysis, notification, and possible remediation.
Workflow details
- Scheduled control: The workflow runs on a schedule and first resets the existing monitoring channels for the configured resources, including successful user logins, Drive downloads, and shared-drive access changes.
- Duplicate prevention: Existing channels are stopped before new ones are created because only one monitoring channel for the same resource can be active at a time. This keeps the monitoring configuration consistent across recurring executions.
- Event coverage: New webhook watches are established for successful login events across users, Drive download activity, and changes to user access on the specified shared drive.
- Workflow handoff: When one of these monitored events occurs, the configured webhook sends the event to separate workflows that can analyze, enrich, notify, and potentially remediate the activity.
- Operational result: The completed flow leaves the specified cloud resources under continuous monitoring, replacing periodic manual setup and channel maintenance with a repeatable scheduled process.
What changed
Monitoring is refreshed automatically on a schedule, with duplicate channels cleared before new watches are created. Events now flow directly through webhooks to separate workflows instead of relying on manual channel setup and maintenance.
Work removed
Manually checking active monitoring channels, stopping duplicate channels, recreating watches for each resource and event type, and maintaining the recurring webhook handoff to downstream workflows.
Expected outcome
Continuous monitoring coverage for three configured cloud activity types, with recurring channel maintenance handled automatically rather than manually.
