Before
An operator would likely review the endpoint request, assess what action was appropriate, and then perform the corresponding response step in the endpoint security tool. The process depended on a person to interpret the request and coordinate the action before reporting the result.
How it works
- Receive an endpoint-related request through the workflow trigger.
- Have the agent assess the request and select an appropriate configured endpoint security action.
- Execute the response and return the resulting status to the requesting process.
Workflow details
- Trigger: A Flowhook request starts the workflow and passes the incoming request to the reasoning and response stage.
- Investigation and decision: An agent reviews the request and uses the configured endpoint security capabilities to determine an appropriate course of action.
- Endpoint response: The agent carries out the relevant available response operation rather than requiring an operator to select and execute each step manually.
- Result delivery: The workflow returns the agent's result as its final output, providing a clear status from the investigation and response cycle.
What changed
The endpoint request is routed directly to an agent that can reason over it and use the configured endpoint security operations in the same workflow. The resulting status is returned automatically, and the definition contains no separate human approval step.
Work removed
Manually reviewing each endpoint request, determining the appropriate response, selecting the endpoint security operation, and relaying the resulting status.
Expected outcome
A consistent, repeatable endpoint investigation-and-response cycle that removes at least one manual review-and-action handoff per request.
