All use cases

Unmanaged Device Discovery and Exposure Monitoring

This automation identifies unmanaged devices and devices with recent activity but no vulnerability-assessment coverage, enriches each record with device and public-internet context, and creates a consolidated Jira ticket. It replaces repeated investigation and reporting steps with a consistent device exposure report.

IP Analysis

IT Asset Management

Security Monitoring

Ticketing

Trigger

The flow starts by querying Axonius for unmanaged devices and recently seen devices without vulnerability-assessment coverage.

Outcome

A Jira issue is created for each matched device with Axonius details and either public-IP intelligence or a no-records result.

Trigger

The flow starts by querying Axonius for unmanaged devices and recently seen devices without vulnerability-assessment coverage.

Outcome

A Jira issue is created for each matched device with Axonius details and either public-IP intelligence or a no-records result.

Before

Analysts likely searched device inventory for unmanaged or insufficiently assessed devices, opened individual records, and copied identifiers and network details into a report. For public IPs, they then performed a separate host lookup, interpreted the result, and manually created or updated a Jira ticket.

How it works

Identify unmanaged devices and recently active devices lacking vulnerability-assessment coverage through Axonius queries.
Retrieve device details and determine whether each device has a public IP requiring an external host and location lookup.
Combine the findings into an enriched Jira ticket, including public-IP results when available or a clear no-records indication.

Workflow details

Device discovery: The workflow queries Axonius to find devices that are not associated with the expected agent or manager coverage, then performs a second search for recently seen devices that are not covered by vulnerability assessment data.
Device validation: For each matching device, the workflow retrieves detailed information including the device identifier, instance, last-seen time, hostname, IPv4 address, and MAC address.
Internet exposure lookup: The workflow checks whether the device has a public IP address. When applicable, it retrieves available host, ISP, and geographic information from Shodan; when no public-IP record is available, it records that no lookup result was found.
Report assembly: The Axonius device details and the applicable public-IP analysis are combined into a structured report for each device.
Ticket delivery: A Jira issue is created with the enriched device report and a timestamp, giving the team a documented handoff for investigating unmanaged or insufficiently assessed devices.

What changed

Device discovery, coverage filtering, record enrichment, public-IP branching, and Jira ticket creation now occur in one workflow for each matched device. The resulting ticket contains the core device data and the applicable exposure context without requiring analysts to move between inventory, lookup, and ticketing tasks.

Work removed

Manually reviewing inventory queries, opening device records one by one, copying device and network details, checking public IPs in a separate lookup, recording missing lookup results, assembling reports, and creating Jira tickets.

Expected outcome

For each matched device, the workflow can remove at least two manual lookup steps and one ticket-creation handoff while producing a consistent investigation record.

Connected tools

Mindflow HTTP

Shodan

Jira

Related flows

All use cases

Explore more workflows with similar topics or tools.

Automated Security Alert Enrichment

This automation runs a complex query against Log Analytics to retrieve Azure Sentinel alerts or other security logs, converts the returned data into JSON, and uses it to update security alerts with additional information. It replaces a manual search-and-update process with a consistent enrichment workflow.

Explore use case

Automated Notable Event Status Updates

This automation receives notable security alerts, locates the corresponding notable event through a controlled search process, and updates its status with a comment in the security platform. It also monitors search completion and emails an administrator when the search fails.

Explore use case

Single-Session User Activity Investigation Reports

This automation investigates the actions performed during a single Azure Active Directory session after a suspicious event. It retrieves the relevant audit history, organizes key activity details into a Workbook, and shares the completed report back with the investigating team.

Explore use case

Less busywork. More possibility.

Let your agents handle the routine. Make room for what comes next.

Let’s talk