Before
Someone would need to review the case list, identify which cases were still open, group them by owner, and compile the relevant ticket details and links. They would then look up each owner in Slack, send the appropriate message, and handle email delivery when the owner could not be found.
How it works
- Retrieve case records and filter them to identify open cases and their owners.
- Group each owner's open cases and build a report containing titles, identifiers, and case links.
- Look up each owner in Slack and deliver the report there when possible, using the configured email fallback otherwise.
Workflow details
- Case retrieval: The workflow requests the available case records from TheHive and uses the returned data as the basis for the notification process.
- Open-case selection: It filters the case list to retain only cases whose status is "Open," then identifies the owners associated with those cases.
- Owner-specific reporting: For each owner, the workflow selects their assigned open cases and builds a readable report containing each ticket title, ticket ID, case ID, and a direct link to the case details.
- Delivery decision: The workflow looks up each owner using their email address in Slack. When a matching user is found, it sends an ephemeral message to the designated channel; when no match is found, it follows the configured email fallback path.
- Notification handoff: Each notification includes a standard greeting, the owner-specific open-ticket report, and a closing message, ensuring recipients receive actionable case information without a separate manual compilation step.
What changed
Open-case reporting becomes an automated owner-by-owner process: the workflow performs the status check, builds the case summary, verifies the recipient's Slack presence, and routes the notification without requiring a person to compile or distribute each report.
Work removed
Reviewing cases one by one, filtering for open status, grouping tickets by owner, copying ticket identifiers and links into messages, searching for each owner in Slack, and manually sending Slack or email notifications.
Expected outcome
A conservative expectation is that at least two recurring owner-level actions—report preparation and notification routing—are removed for each owner processed per run, with the exact time saved depending on the number of open cases and owners.
