Before
Support had to look up the account, count recent lockouts, decide whether an unlock could conceal suspicious activity, and copy the findings into the incident. Suspicious cases also required a separate handoff to the SOC and notification to the security team.
How it works
- Read the account state and document already-unlocked accounts in the incident.
- Count recent lockout events and compare the total with the threshold of three.
- Escalate repeated lockouts to the SOC or unlock and resolve the incident on the ordinary path.
Workflow details
- Trigger: A locked-account incident starts the workflow with the user's login and incident record identifier.
- Account validation: The workflow reads the account state. If the account is already unlocked, it documents that finding in the incident and directs the case toward access diagnosis rather than attempting another unlock.
- Risk assessment: For accounts still marked as locked, it retrieves recent lockout events and counts them. More than three recent lockouts are treated as suspicious activity, while three or fewer follow the ordinary recovery path.
- Resolution or escalation: Suspicious cases remain locked, receive a high-priority SOC assignment in the incident, and generate an alert in the SOC Teams channel. Ordinary cases are unlocked automatically and the ServiceNow incident is resolved with a note that the password remains unchanged.
What changed
The account decision and lockout assessment are produced automatically from the incident trigger. Suspicious activity is handed to the SOC with context, while eligible accounts are unlocked and their incidents resolved without a separate manual investigation.
Work removed
Looking up the account state, retrieving and counting recent lockouts, updating incident notes, assigning suspicious cases to the SOC, posting the Teams alert, unlocking ordinary cases, and resolving the incident.
Expected outcome
Each eligible ticket can remove up to three recurring investigation actions—account lookup, lockout counting, and copying findings into the incident—while repeated lockouts receive an automatic SOC escalation.
