Before
Analysts manually extracted leaked addresses, compared each one with mail and directory records, and determined whether the accounts were active or belonged to former employees. They then closed eligible findings, requested approval for active-account responses, tracked password-change results, and routed separate tickets to the affected brands.
How it works
- Read the finding, extract the leaked addresses, and validate each address against mail and directory records.
- Close cases with no active accounts; otherwise present the active-account assessment for an analyst approval or rejection.
- Record the decision, apply approved password changes, open one ticket per affected brand, and update the finding with the outcome.
Workflow details
- Finding intake: The workflow starts with a finding identifier, reads the finding details, extracts and deduplicates email addresses, and preserves the finding title, severity, source, and status for the response.
- Account validation: Each address is checked against mail and directory records to determine whether an active account exists and to collect available identity, brand, job, office, and domain details. The workflow separates active accounts from addresses that no longer exist in the directory.
- Routing decision: If no active accounts are found, the finding is commented on and closed as a former-employee-only case. If active accounts are present, the workflow prepares an approval request containing the affected accounts and relevant finding facts.
- Controlled remediation: An analyst can approve or reject the password response. Rejection records the decision without changing passwords; approval invokes a password-change action for each active account, with processing limited to five accounts at a time.
- Closure and handoff: After approved remediation, the workflow summarizes the password-change results, opens one ticket per affected brand with the finding and account details, records failures for manual follow-up, comments on the finding, and marks it mitigated. The demonstrated responses are synthetic.
What changed
Account-status checks and routing now happen automatically from the finding, while password changes remain behind an analyst decision. The resulting closure, rejection, remediation status, password-change results, and brand-specific ticket handoffs are recorded as part of the same workflow.
Work removed
Manually extracting and deduplicating leaked addresses, checking each address against mail and directory records, separating former employees from active accounts, assembling approval details, tracking password-change results, and routing separate brand tickets.
Expected outcome
At least two recurring work categories are removed per finding—the account cross-check and initial ticket-routing handoff—while active-account remediation remains approval-controlled and failed changes are clearly identified for manual follow-up.
