Before
Security analysts likely had to search activity logs manually, determine whether a document was sensitive, and compare recent downloads to identify repeated activity by the same user. They then had to assemble investigation details, notify the security team, coordinate approval, and manually sign the user out when remediation was required.
How it works
- Receive each download event, filter out system or irrelevant activity, and classify the document title against sensitivity keywords.
- Check the user’s recent download history for related activity within 24 hours, then notify the security team with the event pattern and available investigation or closure actions.
- If requested, compile the user’s recent Drive activity into a linked report and, after explicit approval, sign the user out and update the security thread.
Workflow details
- Event intake and noise filtering: A secure webhook receives Drive activity events and pauses briefly before processing them. The workflow ignores watch events, system-generated activity, and other non-actionable noise so that security staff are not interrupted by irrelevant records.
- Sensitive document detection: The document title is extracted and compared against a maintained set of confidentiality and business-sensitivity terms, including labels such as confidential, restricted, proprietary, contract, invoice, and agreement. Only downloads that match the defined sensitivity criteria continue to investigation handling.
- Download correlation: The workflow checks recorded download history for the same user and determines whether similar activity occurred within the previous 24 hours. It records the current event and, when relevant, combines it with related events so the security team can see the broader pattern rather than reviewing each download in isolation.
- Investigation reporting: A security notification includes the document title, user email, source IP address, event count, and an investigation option. If investigation is selected, the workflow retrieves the user’s Drive activity from the last 24 hours, formats relevant event details, creates an investigation spreadsheet, appends the activity records, and links the report back to the notification thread.
- Human-approved response: Security staff can close the event or approve further action from the notification. When remediation is approved, the workflow signs the user out of active web and device sessions and posts the remediation result back into the existing security thread; otherwise, it records the event as closed without automatically taking that action.
What changed
Every qualifying download is now triaged automatically and delivered as an actionable security thread instead of waiting for a manual log review. Correlation, sensitivity checks, event collection, report creation, and status updates happen automatically, while investigation, closure, and user sign-out remain explicit analyst decisions.
Work removed
Reviewing download logs one by one; checking document titles against sensitivity indicators; matching a user’s recent downloads across records; assembling investigation spreadsheets; copying event, user, IP, and visibility details into notifications; and manually posting investigation, closure, or remediation updates.
Expected outcome
Each qualifying case can conservatively remove about four recurring manual actions—log review, event correlation, report assembly, and security notification—while giving analysts a documented approval path for investigation and remediation.
