Before
Security staff likely had to review each detection, parse the notification, look up the affected device, and decide which remediation action to take. They then had to submit the device task, notify the responsible team, update the incident, and document the resolution manually.
How it works
- A detection notification is received, normalized, enriched with device and detection context, and evaluated for suitable follow-up actions.
- The responsible team receives the alert with contextual guidance and action buttons, while the final remediation choice remains with the assignee.
- The selected device task is scheduled, the original message is updated, and the detection is resolved with an action and timestamp note.
Workflow details
- Ingestion and normalization: A webhook receives each ESET Protect notification, converts the event content into usable JSON, and extracts the detection identifier, subject, affected user, event time, computer name, and device-group information.
- Context and recommendation: The workflow looks up devices in the relevant group and retrieves matching detection information. It then uses an AI step to generate contextualized follow-up guidance for an on-demand scan, computer shutdown, or user logoff, while identifying a recommended remediation option.
- Human-approved dispatch: The responsible team receives a channel message containing the alert subject, affected user, occurrence time, recommended follow-ups, and action buttons. The assignee retains the decision to launch a scan, shut down the computer, log off the user, or close the event without remediation.
- Remediation execution and tracking: When a remediation action is selected, the workflow maps the selection to the appropriate device task, schedules it for execution approximately one minute later, captures its creation time, and updates the original incident message with the action performed and the affected computer.
- Resolution and documentation: The detection is marked as resolved and a note is added with the person who initiated or approved the action, the action taken, the timestamp, and the computer involved, creating a documented handoff from alert to closure.
What changed
Each detection now arrives as a structured, actionable incident message with device context and recommended response options. Human approval is limited to selecting or closing the event, after which task submission, message updates, resolution, and documentation happen automatically.
Work removed
Manually parsing detection notifications, looking up affected devices and detections, preparing remediation recommendations, notifying the response team, submitting scan or containment tasks, updating incident messages, and recording resolution notes.
Expected outcome
A conservative planning estimate is that at least three recurring manual actions per alert—notification preparation, device lookup, and task submission—can be removed, with resolution details captured consistently.
