Before
Responders likely had to review each incoming finding, look up the affected detection and compute-instance details, and copy the relevant information into a team message. They also had to move between security, URL-analysis, ticketing, email, and cloud-management tools to investigate the URL and coordinate any instance action.
How it works
- Receive a new finding, extract its relevant URL, retrieve the applicable detection details, and assemble the affected-instance context.
- Send the enriched finding to a response channel where a human chooses whether to continue with deeper investigation or instance-focused handling.
- Analyze the URL, collect the result and screenshot evidence, then send the appropriate notification, create a task, or carry out the selected compute-instance action.
Workflow details
- Event intake and enrichment: The workflow starts when a webhook delivers a new security finding. It extracts relevant URLs, identifies the applicable detection resource, and retrieves detailed finding information, including severity, affected instance, network details, timestamps, and a link to the finding.
- Responder decision: A channel notification presents the finding details and asks the responder whether to take further action or request more information. This keeps the key response decision human-approved while removing the need to manually assemble the initial alert.
- Investigation and URL analysis: Depending on the selected path, the workflow submits the relevant URL for analysis, checks whether the scan succeeds, retrieves the results, downloads available screenshot evidence, and evaluates the overall malicious verdict.
- Case handling and communication: The workflow formats the investigation results and routes them to the appropriate outcome. Findings can generate an issue with an overview of the alert, while results with no detected threats can be sent by email with the analysis link and screenshot reference.
- Cloud instance response: The workflow can retrieve details about the affected compute instance and support instance stop or restart actions on the relevant response paths, followed by an additional channel notification containing the finding and action context.
What changed
Finding enrichment, URL-analysis routing, scan-result checks, evidence collection, and downstream notifications now occur as one workflow. The responder retains the decision about the next action, while the system prepares the investigation context and executes the selected follow-up across the relevant services.
Work removed
Manually reviewing each finding, looking up detector and instance details, copying finding data into a team alert, submitting URLs for analysis, checking scan status and verdicts, downloading screenshots, preparing email or ticket content, and manually issuing supported instance stop or start requests.
Expected outcome
For each qualifying finding, the workflow can remove roughly 5–8 recurring lookups, copy-and-paste steps, and tool handoffs while preserving human approval for the response choice.
