Before
Security or cloud teams would likely review inactive-account findings in Wiz, work through additional result pages, and create Jira issues manually for each account. They would then copy details into tickets, notify Slack, add remediation comments, and coordinate any account disablement across separate tools.
How it works
- Retrieve inactive service account findings from Wiz and iterate through all available result pages.
- Create a Jira issue, notify Slack, and add remediation guidance for each finding.
- Apply remediation conditions, disable qualifying accounts, and record the outcome through Jira comments and follow-up Slack alerts.
Workflow details
- Trigger and discovery: The workflow starts when an emailhook event is received, then queries Wiz for inactive service account findings.
- Result handling: It iterates through the returned findings and continues checking additional result pages when more findings are available.
- Tracking and notification: For each finding, the workflow creates a Jira issue with relevant details, posts a high-level Slack message with a link to the issue, and adds a remediation prompt to the Jira ticket.
- Automated decisions: Conditions determine whether a finding should be ignored or proceed through remediation, including a separate check for whether the account should be disabled.
- Remediation confirmation: When the disablement condition is met, the workflow invokes the configured step to disable the service account in Google Cloud, then adds Jira status comments and sends a follow-up Slack alert.
What changed
Findings now move automatically from discovery to ticket creation, notification, conditional remediation, and status updates without a person coordinating each cross-tool handoff. The workflow applies the configured checks before disabling an account; no separate human approval step is shown in the flow.
Work removed
Reviewing inactive-account findings one by one, checking for additional result pages, copying finding details into Jira issues, posting initial and follow-up Slack notifications, adding remediation and status comments, and manually performing the conditional account disablement.
Expected outcome
For each finding, at least four recurring handling actions can be automated—ticket creation, two Slack updates, and Jira remediation or status documentation—with conditional account disablement when the configured criteria are met.
