Before
Analysts monitored the incident queue, identified recently created cases, and checked whether another process had already claimed each one. They then manually separated eligible incidents and handed them off for triage.
How it works
- Start the workflow and calculate the recent incident window.
- Retrieve new incidents and exclude cases already marked with the ownership marker.
- Send each remaining incident to the triage process and return the processing results.
Workflow details
- Trigger and time window: An on-demand webhook starts the workflow, which calculates a 30-minute lookback window for newly created incidents.
- Incident retrieval: The workflow queries Sentinel for new incidents in chronological order, using the calculated window to focus on recent cases.
- Duplicate prevention: Incidents carrying the Mindflow ownership marker are excluded because they are already in progress or have been processed.
- Triage handoff: Each remaining incident is dispatched individually to the triage flow, and the workflow returns the number of incidents sent along with the resulting triage data.
What changed
Eligibility checks and triage handoffs now occur automatically for each run. The workflow uses the existing ownership marker to prevent repeated processing and provides a consistent count and result set for the incidents sent onward.
Work removed
Manually reviewing recent incidents, checking each case for an existing Mindflow marker, separating claimed cases from eligible ones, and dispatching unclaimed incidents to triage.
Expected outcome
A more consistent queue of new investigations, with one automated duplicate check and triage handoff for each eligible incident.
