Before
Analysts would likely retrieve the relevant users and repeatedly collect login and security events for each person during the monitoring period. They would then compare locations, IP addresses, client details, working hours, and activity patterns manually before compiling and sending a report to the team.
How it works
- Run on schedule, retrieve the HubSpot user list, and select the users in scope for monitoring.
- Collect each user's login and security events, then automatically assess patterns, working hours, locations, IP addresses, sensitive actions, and activity bursts for suspicious combinations.
- Consolidate qualifying findings into one Slack report for analyst review, while sending nothing when no anomalous behavior is detected.
Workflow details
- Scheduled monitoring: The workflow runs on a predefined schedule, retrieves the HubSpot user population, and focuses the analysis on users with assigned roles or super-admin status.
- Event collection: For each selected user, it gathers login activity and security activity from the configured monitoring period, then checks whether relevant events are available before continuing.
- Behavior assessment: An automated analysis compares login locations, login times, client information, and IP addresses with observed user patterns and expected weekday working hours. It also evaluates security actions for unusual activity, sensitive operations, administrative actions, or high volumes of actions in a short period.
- Suspicion qualification: A user is reported when the login assessment indicates suspicious behavior and the related security activity supports that conclusion. The resulting assessment identifies the user by email and includes the relevant context, such as IP address, location, and reasons for the classification.
- Analyst notification: Suspicious findings are consolidated into a Slack report and sent automatically. If no users are considered anomalous, the notification step sends nothing; the workflow contains no human approval gate before delivery.
What changed
Each scheduled run now performs the user filtering, event collection, behavioral checks, and suspicious-activity qualification automatically. Analysts receive one consolidated Slack handoff containing the supporting context instead of manually reviewing and reporting each user; human investigation and response remain outside the automated flow.
Work removed
Manually retrieving the in-scope user list, collecting login and security events user by user, checking for relevant events, comparing access patterns and activity volumes, identifying suspicious combinations, and assembling and posting the analyst notification.
Expected outcome
One consolidated Slack notification per scheduled run when suspicious behavior is found, replacing the recurring user-by-user review and reporting cycle; this is an expected operating result, not a measured performance claim.
