Before
Security or IT staff would likely review domain breach results manually, identify affected accounts, generate replacement credentials, and update user records one at a time. They would then gather the breach details and send a separate notification to the responsible team.
How it works
- An incoming email event starts a domain breach scan and retrieves breach details.
- The workflow validates the response, determines whether findings exist, and extracts the relevant breach information.
- For findings, it generates new password hashes, updates affected user records, and posts a summary of the breach and remediation activity to a team channel.
Workflow details
- Breach discovery: An incoming email event starts a domain breach scan and retrieves the available breach information, including the breach name, date, description, and compromised data categories.
- Validation and extraction: The workflow verifies that the scan returned a successful response before extracting the relevant breach details for downstream processing. If no findings are available, it ends successfully without initiating remediation.
- Credential remediation: When findings are present, the workflow processes the affected accounts, generates a new password value, computes a SHA-512 hash, and uses the directory administration process to update the corresponding user information.
- Operational notification: After the remediation loop, the workflow posts a message to a designated team channel with the breach name, date, compromised data, and description, along with the fact that affected accounts were remediated.
- Result: The process replaces a manual sequence of breach review, account updates, and team notification with a repeatable workflow that provides both remediation activity and an auditable operational handoff.
What changed
Breach validation, detail extraction, password-hash generation, user updates, and team notification now occur in one automated path after the triggering email event. Human involvement shifts from coordinating each individual action to reviewing the resulting remediation and notification.
Work removed
Repeatedly reviewing domain breach results, checking whether the scan succeeded, extracting breach details, identifying affected accounts, generating replacement password hashes, updating user records, compiling breach information, and manually notifying the responsible team.
Expected outcome
A complete breach finding can follow a consistent detection-to-remediation path without requiring separate manual account updates and notification steps.
