Before
Security analysts had to review external-sharing events, inspect document titles for sensitive terms, identify the recipient's permission, and move between notification, document-management, and tracking tools. They also had to manually remove access, update the alert, and create a case record after deciding how to handle each event.
How it works
- Detect and screen a document permission event for external recipients and title terms associated with sensitive or regulated content.
- Send the security team the relevant document and sharing context with options to revoke access or close the alert.
- Apply the selected outcome, update the alert status, and record the case and remediation details for tracking.
Workflow details
- Event filtering: The workflow receives a permission-change event, confirms that it represents an editable permission, and checks whether the recipient is outside the organization rather than an internal address.
- Sensitivity screening: It extracts the document title and compares its words against a defined list of confidentiality, legal, contractual, financial, and security-related terms. Events that do not match the required conditions are classified as internal, non-confidential, or otherwise non-relevant.
- Security notification: When an external share matches the alert criteria, the workflow posts a Slack message containing the actor, document title, document owner, recipient, and assigned role, along with buttons to delete the permission or close the alert.
- Analyst-directed remediation: If the analyst chooses remediation, the workflow obtains access to the document, retrieves its permissions, identifies the permission associated with the external recipient, and deletes it. It then updates the original Slack alert to show that the case was resolved.
- Case tracking: Whether the analyst remediates the exposure or closes it as a non-actionable case, the workflow updates the notification and creates an Airtable record containing the case status, assignee, summary, and remediation details for operational tracking.
What changed
The security analyst now makes the remediation or closure decision from a single contextual Slack alert, while permission lookup, access removal, alert updates, and Airtable case creation happen automatically after that decision.
Work removed
Reviewing qualifying sharing events one by one, checking document titles against sensitive-term lists, looking up permissions, identifying the external recipient, deleting access, updating the alert, and separately creating the case record.
Expected outcome
An estimated 5–8 manual actions are removed per incident, while external-sharing decisions and any permission deletion remain documented in the case record.
