Before
Security analysts had to review login events individually, compare them with historical activity, and look up IP, location, client, scope, and timing details across separate tools. They then had to summarize the incident, coordinate a response, and perform token or password remediation through administrative consoles.
How it works
- Receive and triage each successful login event, then extract its user, application, IP, client, scope, and timing details.
- Compare the event with historical activity and contextual checks to determine whether it is suspicious, generating a detailed assessment.
- Notify analysts in Slack for an approve-or-revoke decision, then perform the selected remediation and post the outcome.
Workflow details
- Event intake and triage: A webhook receives successful login events from monitored applications, pauses briefly, and filters out empty or irrelevant payloads before extracting the user, application, timestamp, IP address, client type, and requested scopes.
- Behavioral analysis: An AI agent reviews recent token delivery history for the same user and application, then compares the current event with prior activity. It evaluates changes in IP address, geolocation, travel feasibility, scopes, client type, timing, and whether the IP or subnet has appeared before; for new user-application combinations, it also checks permitted scopes, working hours, and familiar access patterns.
- Suspicion decision and notification: The analysis returns a suspicious or non-suspicious decision with a detailed explanation. Suspicious events are posted to a Slack channel with the relevant context and controls for approving the token or requesting revocation, while non-suspicious events follow a successful completion path.
- Approved remediation: If an analyst selects the remediation option, the workflow revokes the user's application access tokens, creates a temporary password, and updates the user's directory record. If the analyst approves the token, the event is marked as accepted without the remediation actions.
- Resolution recording: The workflow updates the Slack message with the accepted or remediated outcome, including whether the user was signed out and their password changed, so the decision and resulting action remain visible in the incident conversation.
What changed
Login events are assessed automatically and suspicious cases arrive in Slack with the evidence and decision controls already prepared. The analyst retains the approval decision, while the selected token revocation, password update, and resolution handoff are executed and recorded by the workflow.
Work removed
Manually reviewing login events one by one, retrieving historical token activity, checking IP and geolocation details, comparing scopes and client types, writing incident summaries, switching between investigation and administration tools, revoking application tokens, resetting passwords, and posting resolution updates.
Expected outcome
The workflow is expected to remove approximately 10–15 manual actions per suspicious event, based on the documented process, while preserving an analyst-approved response record in Slack.
