Before
An analyst inspected generative AI activity and manually checked each application against the approved list. The analyst then gathered the affected users and application details before notifying the team and opening a case.
How it works
- Retrieve the approved application list and the previous 24 hours of generative AI activity.
- Compare observed applications with the allowlist and group any unapproved usage by application, event count, and user.
- If exceptions exist, notify the security team and create a corresponding incident; otherwise, complete without an alert.
Workflow details
- Trigger: The workflow can run on demand through a secure webhook and was originally designed to run daily at 07:00 in the Europe/Paris time zone.
- Data collection: It reads the approved AI application list and retrieves generative AI application events from the previous 24 hours, including the application and associated user.
- Automated decision: Each observed application is compared with the approved list. Matching applications are ignored, while unapproved applications are grouped with their event counts and distinct users.
- Exception handling: If no exceptions are found, the workflow completes without sending an alert. If exceptions exist, it creates one consolidated summary for the run.
- Operational response: The summary is posted to the security team in Teams and used to open a security-category ServiceNow incident, creating an actionable handoff for review.
What changed
The allowlist comparison, exception grouping, notification, and incident creation now happen automatically in one run. Human reviewers receive a consolidated alert and incident only when unapproved usage is found.
Work removed
Reviewing generative AI events one by one, cross-checking applications against the approved list, counting related events, identifying affected users, copying findings into a team notification, and manually opening a security incident.
Expected outcome
Each exception run automates at least two downstream actions—one consolidated team notification and one security incident—while providing an actionable list of unapproved usage for review.
