Before
Security staff likely had to retrieve detection data, separate individual findings, identify duplicates, and assemble the relevant details manually. They then had to switch to Jira and create an issue for the resulting detection, introducing repeated handling steps for each alert.
How it works
- An incoming email starts the workflow, which retrieves the available Microsoft Defender detections.
- The workflow separates individual detections, removes duplicate events, and builds the issue content.
- The prepared detection is submitted to Jira for tracking, with execution stopping if issue creation fails.
Workflow details
- Trigger and retrieval: An incoming email event starts the workflow, which then retrieves Microsoft Defender detection data through an HTTP request.
- Detection processing: The returned detections are separated into individual events so each finding can be handled independently.
- Deduplication and preparation: Duplicate events are removed, and the remaining detection information is assembled into a structured issue-ready format.
- Issue creation: The prepared detection is submitted to Jira as an issue; if issue creation fails, the workflow stops rather than continuing silently.
What changed
Detection retrieval, event separation, deduplication, and issue preparation now happen automatically after the email trigger. The resulting detection is handed directly to Jira in a consistent workflow, while a failed issue-creation step prevents the process from proceeding unnoticed.
Work removed
Manually retrieving detection data, separating individual detections, checking for duplicate events, assembling issue details, switching to Jira, and creating tracking issues.
Expected outcome
Each incoming alert can be converted into a Jira issue without manual retrieval, parsing, deduplication, or issue creation; conservatively, this removes at least four recurring handling actions per alert.
