Before
Security staff likely had to retrieve recent account audit logs on a recurring basis and review actions individually for unusual or sensitive behavior. When an event looked suspicious, they also had to look up the user's broader login history, validate the source IP, and manually prepare and send an alert to the appropriate team.
How it works
- On schedule, collect the available account information and retrieve the selected account's audit logs from the previous two hours.
- Analyze the events for suspicious or sensitive behavior, then enrich questionable activity with broader user audit history and IP ownership details.
- Produce a structured finding and conditionally notify the security team with the actors, indicators, analysis, and remediation context.
Workflow details
- Scheduled collection: The workflow runs on a predefined schedule, retrieves the available cloud accounts, and collects audit logs for the previous two hours from the selected account.
- AI-powered review: An AI analysis examines actions such as logins, resource creation, and resource deletion, considering the actor, action type, timing, and source IP address. Root-account activity is treated as sensitive by default, with particular attention given to unusual or destructive actions.
- Context enrichment: When an event appears suspicious, the workflow can retrieve additional audit history for the user, especially login activity, and look up IP information such as the associated ASN and company to determine whether the address appears consistent with the expected organization.
- Decision and alerting: The analysis produces a structured assessment identifying whether activity is suspicious, which actors are involved, relevant indicators, and recommended remediation details. If the result warrants escalation, the workflow sends the analysis to the designated team communication channel.
- Operational result: Security personnel receive a focused, evidence-based notification instead of having to manually gather and correlate audit events, user history, and IP information during each review cycle.
What changed
Each scheduled run now performs the audit-log collection, suspicious-activity assessment, contextual lookups, and conditional notification automatically. Analysts receive a detailed escalation only when the analysis identifies activity that warrants attention, while the decision to take remediation action remains with the human team.
Work removed
Repeatedly retrieving recent audit logs, reviewing events one by one, checking sensitive or destructive actions, looking up user login history, validating flagged IP addresses, copying investigation details, and manually notifying the security team.
Expected outcome
At least one recurring manual audit-review cycle is removed per scheduled run, with suspicious findings automatically enriched and routed for analyst follow-up; exact detection or response improvements are not established by the workflow definition.
