Before
Security staff likely had to review authorization events individually, look up recent token activity, compare current and previous IP addresses, and research their locations across multiple tools. For unfamiliar activity, they also had to assemble a notification, wait for a decision, and manually revoke access, reset the account, and document the case.
How it works
- Receive the OAuth token event, check recent history for duplicates, and log new activity.
- Compare the current and previous login IPs using location and distance checks to determine whether the access is familiar.
- Notify Security about unfamiliar activity and apply token revocation, password reset, and case recording when revocation is selected.
Workflow details
- Event intake and deduplication: The workflow receives an OAuth token authorization event containing the user, application, client type, scopes, IP address, and event time. It compares the event with recent activity and spreadsheet history to avoid processing the same token event repeatedly, while recording new events for reference.
- Recent activity review: It retrieves the latest token authorization activity for the user and application, identifies the current and previous login IP addresses, and prepares them for comparison.
- Location enrichment and risk checks: Each IP address is enriched with country, region, city, and geographic coordinates. The workflow compares the two locations and calculates the distance between them, treating the activity as familiar when the locations are in the same country and town and are less than 50 km apart.
- Security handoff: When the location checks fail or the IP cannot be treated as known, the workflow sends Security a detailed Slack notification showing the application, user, flagged IP, previous IP, locations, distance, scopes, and client type. The notification includes separate options to approve the token or revoke it.
- Containment and case recording: If Security chooses revocation, the workflow deletes the application's access tokens for the user, generates a temporary password, forces a password change at the next login, updates the security notification, and creates a resolved record containing the remediation details.
What changed
Authorization events now arrive with an automated duplicate check, recent-activity lookup, IP enrichment, and location-based risk decision. Familiar activity is classified automatically, while unfamiliar activity is handed to Security in a structured notification with the containment actions connected to the revocation decision.
Work removed
Searching recent authorization history, checking event timestamps against spreadsheet records, looking up the current and previous IP locations, calculating the distance between logins, copying event details into a Security notification, manually revoking application tokens, resetting the user's password, and creating the remediation record.
Expected outcome
Conservatively, the workflow can remove at least four recurring manual actions per investigated event, while preserving human approval for suspicious-token handling.
