Before
Analysts likely had to review WAF alerts individually, look up each source IP in a reputation service, and decide how to route the result in Jira. They also had to transfer the alert summary and enrichment findings into the incident by hand.
How it works
- Receive a WAF alert and look up its source IP reputation.
- Classify the result as benign or recognized scanner activity, or as malicious or not found.
- Create the corresponding low- or high-priority Jira incident and add the analysis for follow-up.
Workflow details
- Alert intake: The workflow receives a web application firewall alert and extracts the relevant IP address for reputation analysis.
- Reputation enrichment: It queries the IP reputation service to determine whether the address is associated with benign internet scanning activity, malicious activity, or no matching result.
- Automated classification: The workflow evaluates the reputation result and follows a separate path for benign or recognized scanner activity versus malicious or unavailable reputation data.
- Incident creation: Benign or recognized scanner results are routed to a low-priority Jira incident, while malicious or not-found results are routed to a high-priority Jira incident containing the security alert summary.
- Analyst handoff: The workflow adds the available analysis to the resulting Jira issue so the investigation begins with the enrichment context already attached.
What changed
IP reputation enrichment and routing now occur automatically when the alert arrives. Jira receives a classified incident with the appropriate priority path and available analysis, replacing the manual lookup and handoff sequence.
Work removed
Manually looking up source IPs, reviewing reputation results, deciding whether an alert follows the low- or high-priority path, creating the Jira incident, and copying the alert analysis into the issue.
Expected outcome
At least one manual IP lookup and one manual Jira-routing decision are removed for each processed alert, while analysts receive classified incidents with enrichment context already available.
