Before
An operator would likely search the device inventory manually using the user's email address, open the device's extension attributes, and interpret the stored DNS resolver text. They would then compare the resolver with the authorized value and copy the finding into the appropriate Slack channel, creating repeated lookup and handoff work.
How it works
- Receive the target user's email address from a Slack-triggered webhook and obtain an authentication token for the device inventory lookup.
- Find the user's computer record, extract the DNS resolver extension-attribute data, and convert the formatted text into structured nameserver information.
- Compare the first nameserver with the authorized resolver and post an alert with the detected value to the initiating Slack channel when it is not authorized.
Workflow details
- Request intake: The workflow starts when a Slack bot command sends a target user's email address through a secure webhook.
- Device lookup: It authenticates with the device-management platform and searches computer inventory records for the device associated with that email address.
- Resolver extraction: The workflow reads DNS resolver information stored in the device's extension attributes, replaces escaped line breaks, and converts the result into structured resolver data.
- Compliance check: It evaluates the first detected nameserver against the configured authorized DNS resolver to determine whether the device is using an approved configuration.
- Notification: When the resolver does not match the authorized value, the workflow posts a message containing the user and detected resolver details to the Slack channel that initiated the request; if the check does not identify an unauthorized resolver, the flow completes without sending that alert.
What changed
A Slack request now initiates the device lookup, resolver extraction, formatting, and authorization check automatically. The requesting channel receives the unauthorized-resolver finding without requiring an operator to move between inventory records and Slack, while an approved resolver ends the flow without an alert.
Work removed
Manually searching inventory by user email, opening and interpreting DNS resolver extension attributes, cleaning up resolver text, comparing the detected resolver with the authorized value, and copying unauthorized-resolver findings into Slack.
Expected outcome
Each request produces a consistent resolver compliance check and, when needed, an immediate Slack handoff of the unauthorized resolver details without manual investigation steps.
