Before
Security or support staff likely had to open the incoming alert, retrieve the related alert details and screenshot, and manually create a support ticket. They then had to test the credentials, decide whether the leak was genuine, and reset the user's password when necessary.
How it works
- Receive the leaked-credential alert and retrieve the associated alert details and screenshot.
- Create a support ticket, test the reported credentials, and automatically evaluate whether they are compromised.
- Reset the affected user's password when the check confirms a leak, or complete the workflow without a reset when it does not.
Workflow details
- Alert intake and investigation: The workflow starts when an email alert is received, then retrieves the corresponding alert details and screenshot from the digital risk monitoring service for review.
- Issue documentation: It creates a Freshservice ticket containing the affected email, requester information, issue description, subject, priority, and status so the alert is formally recorded for support handling.
- Credential validation: The workflow sends a request to test the reported credentials and evaluates the result through a credentials-leaked decision point.
- Remediation decision: When the validation confirms that the credentials are compromised, the flow resets the affected user's password through the identity service. If the credentials are not confirmed as leaked, it bypasses the reset and continues to completion.
- Completion: Both paths end with a successful workflow result after the alert has been investigated, documented, and either remediated or cleared based on the credential check.
What changed
Each incoming alert now moves through investigation, ticket creation, credential validation, and conditional remediation automatically. The human handoff changes from coordinating separate lookups and actions to receiving a documented ticket and a completed or conditionally remediated response.
Work removed
Manually retrieving alert details, obtaining the alert screenshot, creating the support ticket, testing the credentials, reviewing the validation result, and resetting the user's password when compromise is confirmed.
Expected outcome
For each alert, the workflow can remove approximately four to five recurring manual actions while ensuring that confirmed compromised credentials receive an automated password reset.
