Before
An administrator would likely revisit each configured application, check whether its event watch was active or stale, stop old channels, and recreate watches with the appropriate event filter and destination. This required repeating the same setup across the six application categories and coordinating the handoff to the downstream analysis flow.
How it works
- A scheduled or webhook-triggered run loads the configured application watch definitions.
- The workflow processes each application one at a time, stops its existing channel, and creates a fresh webhook watch with the matching authorization-event filter.
- The resulting watch channels forward future application events to the downstream monitoring and remediation flow.
Workflow details
- Scheduled orchestration: The workflow runs on a predetermined schedule, with an additional webhook trigger available to invoke the watch-management process when needed.
- Application coverage: It iterates through six configured application categories—Slack, macOS, iOS, Android device, SamsungCalendar, and iOSAccountManager—using each application's identifier, resource, and event filter.
- Channel cleanup: Before creating a new watch, the workflow stops the existing watch channel for the application so stale or duplicate monitoring channels are not left in place.
- Watch creation: It creates a webhook-based authorization event watch for each application, using the relevant application filter and configured downstream destination.
- Operational result: Future events from the selected applications are prepared for forwarding into the downstream login-monitoring flow, supporting continuous coverage across the defined application set.
What changed
Watch maintenance now happens automatically on a recurring schedule across all six configured application categories. The workflow performs channel cleanup and recreation sequentially, so the downstream monitoring flow receives a refreshed event-monitoring setup without a person repeating the same configuration for each application.
Work removed
Manually checking each application's watch status, stopping stale channels, recreating watch channels, applying per-application event filters, and configuring the downstream webhook destination.
Expected outcome
One scheduled execution can refresh monitoring for all six configured application categories, eliminating up to six recurring per-application watch-management checks per run.
