Before
Security engineers manually ran each network search, reviewed the returned hosts, copied findings into a spreadsheet, and documented queries with no results. They then composed and distributed a team notification with the completed report link after each scan cycle.
How it works
- A scheduled trigger prepares predefined network-misconfiguration queries and runs them across the targeted network scope.
- The workflow evaluates each query, records matching host details or a no-results status in the report, and tracks whether any findings exist.
- If findings are present, the security team receives a channel notification with a link to the completed report.
Workflow details
- Scheduled monitoring: A scheduler starts the workflow at a predetermined interval and prepares a set of queries focused on network misconfigurations such as default credentials, exposed access panels, root access, and unsecured VNC services.
- Automated scanning: Each predefined query is submitted for the targeted network scope, and the returned results are evaluated to determine whether matching hosts were found.
- Finding capture: When matches are identified, the workflow records relevant host details, including the query, IP address, hostname, provider information, and returned service data, in a spreadsheet.
- Clean-status documentation: Queries with no matches are also recorded with a clear no-results status, creating a complete record of both detected issues and checks that returned no findings.
- Conditional notification: After the scan cycle, the workflow checks whether any findings were detected. If so, it sends the security team a channel notification containing a link to the full report for review and follow-up.
What changed
The complete scan, validation, documentation, and conditional notification cycle now runs automatically on schedule. Security staff receive a report link only when the workflow identifies findings, while every query remains documented regardless of outcome.
Work removed
Manually running each network query, reviewing results one by one, copying host details into a spreadsheet, recording clean query results, compiling the report, and drafting the team notification.
Expected outcome
A conservative estimate is 10–20 minutes saved per scheduled scan cycle, with consistent documentation of findings and clean results.
