Before
An analyst inspected recent Google Workspace authorization activity and checked each application or domain against the approved list. Exceptions then required manual compilation, team notification, and incident creation.
How it works
- Retrieve the approved application and OAuth client ID list and read recent authorization activity.
- Compare each authorization with the allowlist and retain only unmatched applications or client IDs.
- Consolidate exceptions into one summary, notify the security team, and open a security incident; take no action when no exceptions are found.
Workflow details
- Trigger and window: The workflow starts from an on-demand webhook and calculates a 15-minute lookback window for reviewing recent OAuth authorization activity.
- Authorization review: It retrieves the approved application and OAuth client ID list, then reads recent Google Workspace authorization events, including the application name, client ID, user, scopes, and event time.
- Automated decision: Each authorization is compared with the allowlist. Approved applications or client IDs are ignored, while unmatched authorizations are recorded as unapproved usage.
- Exception handling: If exceptions exist, the workflow combines them into one summary, sends one alert to the security team in Teams, and creates one security incident in ServiceNow. If none are found, the run completes without sending an alert or creating a ticket.
What changed
Allowlist validation and exception filtering now happen automatically within the review run. Only unmatched authorizations enter a single notification and ticket handoff, while approved activity and empty runs are closed without escalation.
Work removed
Reviewing authorization events one by one, cross-checking application names and client IDs against the allowlist, compiling exception details, manually notifying the security team, and creating a corresponding incident.
Expected outcome
Each run with exceptions produces one consolidated security alert and one incident instead of requiring separate manual handling for every detected authorization.
