Before
Analysts had to inspect location-change events, find the affected user, copy the sign-in details into a message, and ask whether the activity was legitimate. They then had to wait for a response or timeout, record the outcome, and open a service request when the user did not recognize the sign-in.
How it works
- Validate the new-country sign-in event and collect its user, location, network, device, IP, and timing details.
- Find the user and send a confirmation request with options to recognize or reject the activity, including a response wait period.
- Record the decision or timeout, and route unrecognized activity to a service request and security alert.
Workflow details
- Trigger and validation: A webhook receives a sign-in event, and the workflow continues when the event indicates a positive new-country condition. It extracts the event time, user email, country, city, network, device, and IP address.
- User confirmation: The workflow looks up the user, sends a detailed security message with the sign-in context, and presents options to confirm the activity or report that it is not recognized. It waits for a response for up to 24 hours.
- Recognized path: When the user confirms the login, the message is updated and the result is appended to the security log as confirmed, without creating a service request.
- Unrecognized path: When the user reports unauthorized activity, the message is updated, a service request is created with the event details and recovery actions for an analyst, the request is given an incident summary, and a critical security alert is posted for follow-up.
- No-response path: If the user does not respond before the wait period ends, the message is updated and the event is recorded in the security log as having no response.
What changed
Each qualifying sign-in now follows an automated validation, user-confirmation, logging, and escalation path. The user supplies the recognition decision, while the workflow updates the message, records the result, and alerts the security team or creates a service request when the activity is rejected.
Work removed
Finding the affected user, copying country, city, network, device, and IP details into a confirmation message, monitoring for a reply or timeout, transcribing the outcome into the security log, and opening and updating a service request for unrecognized activity.
Expected outcome
Conservatively, at least three recurring analyst actions per qualifying event—user lookup, confirmation outreach, and outcome transcription—are automated, while every event receives a consistent log record and unrecognized activity receives a service request.
