Before
An analyst would likely search for the relevant hosts in the endpoint security console, start a remote response session, retrieve and review the process list, and identify the correct process ID. They would then issue the termination command and manually return to the team channel to communicate whether the action succeeded or failed.
How it works
- A chat webhook starts the workflow, which retrieves available hosts and presents them for analyst selection.
- The workflow opens a remote response session, lists processes on the selected hosts, validates the returned session data, and presents the available processes for selection.
- After the analyst selects the process, the workflow sends the termination command, checks for errors, and reports the result in the same chat channel.
Workflow details
- Chat-initiated response: A webhook from the internal communication tool starts the workflow and preserves the conversation channel for the interactive response.
- Host discovery and selection: The workflow retrieves hosts covered by the endpoint security platform, formats their hostnames as selectable options, and asks the analyst to choose the machine or machines requiring investigation.
- Process inspection: After the analyst selects hosts, the workflow starts a remote response session and runs a process-listing command across the selected endpoints. It checks whether the session is complete, extracts the returned process data, and formats process names and process IDs for selection.
- Human-directed termination: The analyst selects the process or processes to stop from the chat message. The workflow then sends a termination command to the selected endpoints using the chosen process ID.
- Status reporting: The workflow checks the termination response for errors and posts either the command output or an error message back to the originating chat channel, leaving the final operational decision with the analyst while automating execution and reporting.
What changed
Host discovery, process inspection, command execution, error checking, and status reporting now occur through one guided chat interaction, while the analyst retains control over which host and process are selected.
Work removed
Manually searching for hosts, starting remote response sessions, running process-listing commands, reviewing process IDs, issuing termination commands, and copying success or error details into the team channel.
Expected outcome
Each run is expected to remove approximately four to six recurring manual actions and deliver a documented termination status in the originating chat channel.
