Before
Responders likely had to open each unusual login alert, extract the actor and IP details, look up recent activity and IP reputation, and coordinate ownership through separate tools. They then had to manually suspend or update the account, change the password when required, update the SIEM status, and communicate the outcome to the team.
How it works
- Receive the SIEM alert, extract the relevant identity and event details, and send the team an interactive notification.
- Assign the alert and, when requested, enrich it with recent login activity, repeated-event counts, and IP reputation information.
- Apply the responder's selected action—close, suspend, or suspend and change the password—then update the alert and notification with the result.
Workflow details
- Alert intake and notification: A SIEM webhook starts the workflow when an unusual login alert is raised. The flow extracts the alert severity, name, actor email addresses, IP address, and creation time, formats the timestamp, and posts an interactive notification containing the alert context and available response actions.
- Ownership and alert coordination: When a responder is identified, the workflow retrieves the responder's information, assigns the alert to that person, and updates the notification to show the assignment. The alert can then be handled through the same interactive response thread rather than through separate manual handoffs.
- Optional enrichment: If the responder chooses enrichment, the flow reviews the user's recent successful login activity, checks whether the IP address has appeared in that activity, counts matching events since the prior day, and retrieves the IP's abuse confidence score. These findings are added to the notification thread with new options to remediate or close the alert.
- Human-directed remediation: A responder chooses whether to remediate or close the alert. For remediation, the workflow asks whether the account should be suspended only or suspended with a password change, then performs the selected account action in the directory service.
- Status and communication updates: After the selected action, the workflow updates the alert status to resolved or closed, refreshes the original notification, and posts the outcome and responsible user to the notification thread. The workflow returns a completion result describing the case outcome.
What changed
The alert now arrives with its key context and response controls already prepared in one notification thread. Assignment, enrichment, account actions, status changes, and follow-up messages occur automatically after the responder makes the relevant choice, replacing tool-by-tool coordination with a controlled human-approved handoff.
Work removed
Extracting alert fields, formatting timestamps, notifying the team, looking up the responder, assigning the alert, checking recent login activity, counting matching IP events, checking IP reputation, suspending the user, changing the password, updating the SIEM status, and posting completion updates.
Expected outcome
For each eligible alert, the workflow can remove roughly 5–8 discrete manual actions and provide a documented closure or remediation update without requiring the responder to repeat the same lookups and status changes.
