All use cases

Flag Large Watchlist Downloads

This automation monitors alert data for large-download activity associated with employees on a watchlist and creates a Jira issue when the configured condition is met. It converts a recurring security review and escalation process into a structured issue handoff.

Security Monitoring

Insider Threat

Threat detection

Ticketing

Trigger

An event received through the emailhook trigger starts the flow and causes recent alert data to be compared with the employee watchlist.

Outcome

For an alert that meets the watchlist condition, the flow creates an issue in Jira for follow-up.

Trigger

An event received through the emailhook trigger starts the flow and causes recent alert data to be compared with the employee watchlist.

Outcome

For an alert that meets the watchlist condition, the flow creates an issue in Jira for follow-up.

Before

Security or operations staff would likely retrieve recent alerts, expand or review employee watchlist entries, and compare the alerts against those employees manually. A matching large-download alert would then need to be handed off into Jira as a new issue.

How it works

Receive the triggering event and retrieve recent alert data for the monitored period.
Process the employee watchlist and evaluate whether each relevant alert matches a watchlisted employee.
Create a Jira issue automatically when the configured matching condition is met.

Workflow details

Trigger and alert collection: The workflow starts when an event is received through an emailhook trigger, then retrieves recent alert data from Netskope for the configured 30-day period.
Watchlist preparation: It processes the employee watchlist data so that alert activity can be evaluated against the people being monitored.
Automated matching: A condition checks whether an alert is associated with an employee on the watchlist, using the configured matching criteria before any issue is created.
Issue handoff: When the condition is satisfied, the workflow creates an issue in Jira, giving the receiving team a structured record of the qualifying alert.

What changed

Alert retrieval, watchlist preparation, and the matching check now occur automatically after the trigger. Qualifying alerts are handed to Jira without a separate manual issue-creation step.

Work removed

Retrieving recent alerts, expanding the employee watchlist, comparing alerts with watchlisted employees, and creating a Jira issue for each qualifying match.

Expected outcome

Expected outcome is one Jira issue per qualifying watchlist alert, removing at least one manual alert-to-issue handoff for each match.

Connected tools

Jira

Mindflow HTTP

Related flows

All use cases

Explore more workflows with similar topics or tools.

Automated Security Alert Enrichment

This automation runs a complex query against Log Analytics to retrieve Azure Sentinel alerts or other security logs, converts the returned data into JSON, and uses it to update security alerts with additional information. It replaces a manual search-and-update process with a consistent enrichment workflow.

Explore use case

Automated Notable Event Status Updates

This automation receives notable security alerts, locates the corresponding notable event through a controlled search process, and updates its status with a comment in the security platform. It also monitors search completion and emails an administrator when the search fails.

Explore use case

Single-Session User Activity Investigation Reports

This automation investigates the actions performed during a single Azure Active Directory session after a suspicious event. It retrieves the relevant audit history, organizes key activity details into a Workbook, and shares the completed report back with the investigating team.

Explore use case

Less busywork. More possibility.

Let your agents handle the routine. Make room for what comes next.

Let’s talk