Before
Analysts had to revisit every affected Jira issue or Confluence page after an incident was closed, read the current content, and determine whether the exposed content was gone. They also had to record the result, reopen incidents that still contained the content, and remind the owner when follow-up was required.
How it works
- Retrieve the incident and identify its affected Jira issues and Confluence pages.
- Read and rescan each source, then classify the result as removed, still present, or unverified.
- Confirm closure and tag the incident, request a manual check, or reopen the incident and remind its owner.
Workflow details
- Incident and location review: The workflow receives an incident ID and optional occurrence data, retrieves the incident details, and identifies the affected Jira issues and Confluence pages that need to be checked.
- Current-content validation: Each selected source is read for its current content, then rescanned to determine whether the reported detector or exposed content is still present. Jira issues and Confluence pages are processed separately and checked one at a time.
- Automated verdict: If all available rescans succeed and no matching content remains, the incident is treated as remediated. If a match remains, the incident is treated as still exposed; if no location can be verified or a rescan fails, the result is marked unverified.
- Closure handling: A verified result records a closure confirmation and applies a verification tag. An unverified result records that a manual check is needed, while a still-present result reopens the incident, adds a reopening note, and triggers a reminder to the owner.
- Operational result: The workflow creates a documented closure decision based on current source content rather than relying only on the incident's previous status, while preserving a human review path for uncertain cases.
What changed
The closure decision is now based on automated rescans of the current source content. Verified removals are documented and tagged automatically, uncertain checks are routed for manual review, and remaining exposures trigger reopening and owner notification without a separate analyst handoff.
Work removed
Revisiting affected source documents, reading their current content, running removal checks, comparing scan results with the incident detector, recording closure or reopening notes, applying the verification tag, and manually reminding the owner.
Expected outcome
A documented remediation decision for each incident, with up to six source-location checks handled automatically when three Jira issues and three Confluence pages are present.
