Before
Security staff would likely review password-manager events, filter login activity, and manually map user IDs to email addresses. They would then compare IP addresses across reported device records and directory activity before compiling and sending a security-team notification.
How it works
- On a scheduled interval, collect recent password-manager events and isolate login events.
- For each login, identify the user and compare the event IP with reported and directory activity, including checks for recognized mobile-device activity.
- Aggregate suspicious findings into a structured notification for the security team to review and act on.
Workflow details
- Scheduled collection: A scheduler starts the workflow at a predetermined interval and defines the time window for collecting recent password-manager events, described in the flow as the last two hours.
- Login-event triage: The workflow retrieves events, keeps only type 1000 login events, and stops with an explicit status when no events or no matching login events are available.
- User and IP correlation: For each login, it maps the event user ID to an email address, retrieves the user's reported IP information from a spreadsheet, and compares the login IP with the most recently recorded address.
- Suspicious-activity checks: When the IP does not match, the workflow reviews up to 10 recent authorization activities for that user and checks whether the address is associated with recognized mobile client activity. IPs missing from directory activity or not associated with an identified mobile device or company laptop are marked for alerting.
- Security handoff: The workflow compiles the flagged user's email, event time, IP address, investigation context, suspicion status, and recommended follow-up actions into a contextualized message formatted for the designated security Slack channel. The flow prepares the notification for human follow-up and does not show an automated account change or remediation action.
What changed
Login monitoring now runs on a schedule and performs the user, IP, directory, and device-activity checks automatically. Security staff receive a structured summary of suspicious findings instead of assembling the evidence manually, while the decision to investigate or remediate remains with the team.
Work removed
Running recurring login-event searches, filtering login events, mapping user IDs to email addresses, looking up reported IP addresses, reviewing recent directory activity, comparing IP and device records, checking mobile-client indicators, and manually compiling the security notification.
Expected outcome
Expected outcome is continuous scheduled coverage of recent login events with one consolidated alert for each run that identifies IP mismatches and missing device or directory evidence; no measured time-savings result is provided.
