Before
A reviewer repeatedly checked the findings list for new data leaks and separated relevant entries from other finding types. The reviewer then handed each relevant finding to the account triage process and compiled the results manually.
How it works
- Retrieve the current findings list when the workflow is triggered.
- Keep only entries marked as new data leaks and send each selected finding to account triage, with up to three processed at once.
- Count the processed findings and return a consolidated outcome summary.
Workflow details
- Trigger and retrieval: The workflow starts through a secure on-demand webhook and retrieves the current findings list from the leak-monitoring service. The flow was originally designed for scheduled hourly execution during business hours.
- Selection: It keeps only findings classified as data leaks with a new status, while leaving exposed services and vulnerabilities to other workflows. This creates a focused queue for account-level assessment.
- Triage handoff: Each selected finding is passed to the account triage workflow with its finding identifier. Up to three findings are processed concurrently, and each triage run returns an outcome such as close, remediate, or declined together with a one-line summary.
- Reporting: The workflow counts the findings handled and combines the individual results into a run summary. If no matching findings exist, it returns an explicit no-new-finding message.
What changed
The workflow now performs the finding filter and triage handoff automatically, processes up to three selected findings concurrently, and produces the run summary without a reviewer assembling it manually.
Work removed
Repeatedly monitoring the findings list, filtering new data-leak entries from unrelated findings, copying finding identifiers into the triage workflow, and compiling per-finding outcomes.
Expected outcome
Each run removes one manual queue review and handoff per selected finding, while supporting triage of up to three findings concurrently.
