Automation use cases

This automation analyzes uploaded third-party contracts against GDPR, DORA, ISO 27001, and internal governance and security references. It produces a prioritized compliance and risk assessment with consolidated gaps, remediation recommendations, draft contractual clauses, an HTML dashboard, and an Excel report delivered to the requester.

This automation turns a user's basic image idea into an enriched image-generation prompt, submits it for image creation, and keeps the requesting Slack message updated with the enhanced prompt and resulting image. It also detects when an upscale option is available and can submit the corresponding upscale request automatically.

This automation retrieves pending AI analyst incidents from the previous seven days, enriches them with linked incident context, and presents concise reports with interactive review actions in a shared Slack thread. Analysts can acknowledge selected incidents directly in Darktrace while keeping the team informed of each decision.

This automation turns Slack employee support requests into structured, policy-informed service workflows. It gathers conversation context, classifies the request, validates missing details, manages approval requirements, creates the appropriate ticket, and keeps the requester informed.

This automation maintains scheduled monitoring for upload activity in Google Drive by replacing the existing watch channel before it expires and creating a renewed notification channel. It helps prevent monitoring gaps while reducing the need to manually manage watch renewals.

This automation examines every attachment in an incoming email for potential malware and evaluates each file through a security analysis service. When a malicious file is identified, it creates an incident issue, alerts the security team, and generates an analysis report; clean emails complete successfully.

Mindflow automates the analysis of files with Hybrid Analysis upon receipt via webhook, followed by dispatching results directly to users through email.

This automation analyzes an incoming phishing email by extracting sender addresses, URLs, and attachments, then checking each available indicator against reputation and threat-intelligence services. It consolidates the findings into a formatted report and emails the results to the requester.

This automation sends approval requests to Slack, captures whether a reviewer selects Approve or Deny, and posts the corresponding status update. It replaces manual follow-up and decision routing with an event-driven approval process.

This automation coordinates the approved deactivation of a user's related accounts across Google Workspace, Okta, and GitHub. It gathers account details, routes the request for approval, performs the account changes, updates Jira, and confirms completion with the manager and approver.

This automation identifies active IAM access keys that have not been used for more than 90 days, gathers the related user and issue evidence, and creates a trackable incident for review. It gives the responder a clear choice to deactivate the key or ignore the issue, then records the decision and closes the incident.

This automation turns a new employee event into an approval-driven onboarding process across identity, collaboration, and work-management systems. It creates the approved employee accounts, applies a conditional Microsoft 365 license, records the actions in a Siit ticket, and sends the manager a Slack summary for review.

This automation manages Azure user offboarding through a documented approval process in Jira. It gathers the user record, creates an approval request, follows up when no decision is recorded, and then either deletes the account and notifies stakeholders or records the disapproval.

This automation finds approved virtual patch incidents, creates an enabled on-demand Windows patch job for each incident's asset and vulnerability QIDs, and records the resulting job in the incident. It replaces the recurring lookup, job setup, and tracking updates with a scheduled process.

This automation turns a webhook command containing one or more web extension URLs into a controlled blacklist update in Jamf Pro. It identifies the extensions, obtains user approval in Slack, updates the relevant OS X configuration profile, and reports whether the request was completed or canceled.

This workflow manages Google Workspace users and groups from Slack commands while checking whether the requester is authorized. It applies the requested suspension, unsuspension, or deletion and posts the result back to a designated Slack channel.

The use case involves integrating Slack, AWS Comprehend, and OpenAI to anonymize PII in Slack messages before sending them to ChatGPT. This ensures data privacy and compliance while leveraging AI insights, enhancing security and productivity in communication workflows.

This use case simplifies vulnerability management by integrating CrowdStrike Falcon Spotlight with Drata. It automates the extraction of vulnerability data from CrowdStrike and seamlessly uploads it to Drata, improving security compliance documentation and reducing manual effort in vulnerability tracking and reporting.

This automation reviews every user in a tenant to determine whether the account is activated and whether multi-factor authentication is enabled. It automatically enables MFA for activated users who lack it and sends activation emails to users who are not yet activated.

This automation receives Microsoft 365 audit notifications, filters out subscription-validation messages, retrieves the complete event, and routes it according to its workload. It replaces manual audit review and handoff with an automated path to the appropriate Azure Active Directory, OneDrive, or Exchange analysis flow.

This automation identifies personnel records in Drata that do not have background check evidence and adds the available evidence to those records. It replaces repeated compliance lookups and uploads with a structured process that supports regulatory readiness.

This scheduled automation compares bank transactions with ERP ledger entries, identifies matches and discrepancies, and proposes journal entries for unresolved issues. It routes proposed adjustments to finance for approval, posts approved entries to the ERP, and creates a complete reconciliation log for tracking.

Automatically retrieves recent botnet IP and port indicators, filters them for high-confidence botnet command-and-control activity, and updates a firewall blacklist on a recurring schedule. The workflow combines new indicators with the existing list, removes duplicates, and publishes the consolidated blacklist.

This automation performs scheduled scans of the company domain to identify email addresses exposed in known breaches, then initiates password remediation for affected accounts. It delivers the breach details and remediation activity to a designated Slack channel so security teams can act from a centralized notification.

This automation receives bulk update data, authenticates with Salesforce, and processes Asset record updates through a batched ingest job. It monitors batch progress, marks the job complete, and posts a status message to a Slack channel.

This automation receives a request containing Chrome extension names, identifies their extension IDs, and adds them to a JAMF Pro Chrome blocklist configuration profile. It preserves the existing entries, updates the profile, and notifies a Slack channel when the change is complete.

This automation retrieves the CISA known exploited vulnerabilities feed, filters entries to a configured date range, and checks each CVE against vulnerability data in Tenable. When a matching vulnerability is found, it reports the finding to the security team in Microsoft Teams and creates a Jira issue for tracking.

This automation turns Microsoft Defender Cloud alerts into tracked security work, notifies the security team, and routes the alert based on the team’s response. It can escalate the incident, initiate an endpoint scan, and record the resulting action in the associated ticket.

This automation evaluates AWS environments against compliance standards by collecting WAF and VPC configuration details, identifying non-conforming environments, and compiling the findings into a report. The completed report is archived and delivered through the designated security channel.

This automation provisions a complete cloud project foundation by creating a project, private network, security group, and server, then adding an application user to a group. It replaces a sequential, multi-service setup process with an ordered workflow that stops if a step fails.

This automation identifies AWS EC2 instances that are missing required tags, notifies a designated Slack channel, and applies the required tags automatically. It then updates the Slack notification to show that tagging is complete.

This automation monitors HashiCorp Vault cluster replication health by retrieving the required Vault data, validating the status response, and evaluating primary and secondary health conditions. It sends targeted Slack notifications when problems are detected or when status updates need to be shared.

This automation receives a command payload and relays it to an MCP server through an HTTP request. It returns the server response directly, removing the need to manually send the request and retrieve its result.

This scheduled automation compares Eng-tagged computer inventory with the devices currently assigned to an application access list, then adds missing devices and removes outdated ones. It keeps conditional access authorizations aligned with the latest asset records and notifies the team of the changes.

This automation identifies whether a person already exists as a contact by searching for their first and last name, then validating the associated company using its domain or name. It returns the matched contact ID when a reliable match is found or clearly reports that no contact was found.

This automation checks the email accounts of users in a domain against known data breaches and records the findings in a spreadsheet. It replaces repeated account-by-account searches and manual result entry with a centralized breach inventory.

This scheduled workflow scans public-facing assets for vulnerabilities, filters for critical findings, enriches each qualifying CVE with vulnerability details and available proof-of-concept information, and then updates or creates the related Jira ticket. It assigns the issue to the appropriate team member and sends the assignee a notification with the ticket link and summary.

This automation receives Lacework CSPM alerts, identifies compliance violations, applies the corresponding AWS remediation, and creates a Jira ticket with the alert context and remediation history. It replaces manual investigation and documentation with a repeatable, auditable response process.

This automation classifies a submitted job title and optional profile summary as Cyber, IT&Cloud, or None. It replaces repeated manual role matching with a consistent category returned directly to the requesting system.

This automation delivers a personalized cybersecurity awareness questionnaire, scores each response, records the results, and determines whether the participant passes. Successful participants receive a congratulatory message and an emailed certificate, while unsuccessful participants receive targeted follow-up guidance.

This automation searches Shodan for recent hostname findings, removes duplicate hits, and sends relevant results to Slack and Splunk. When a finding involves a configured dangerous port, it also creates a Jira issue so the exposure can be addressed promptly.

This automation runs recurring searches for keyword-related data leaks, retrieves matching intelligence records, and analyzes the associated dumps in either text or CSV format. It extracts relevant matches together with dump names and dates, producing structured findings ready for investigation or response actions.

This scheduled workflow finds ServiceNow incidents resolved since the previous day and closes the corresponding CrowdStrike detections. It removes the need to manually reconcile resolved incidents with security detections and update each detection individually.

This automation investigates CrowdStrike detections, applies conditional containment and enrichment actions, and records the findings in ServiceNow. It reduces the need for analysts to manually collect evidence, search file hashes, manage endpoint containment, and update incident records.

This automation manages device unlock requests from intake through approval, Jamf Pro command execution, and user communication. It replaces repeated account and device lookups with a controlled approval workflow that either queues the unlock or clearly communicates the decline.

This automation turns scheduled device inventory data into structured compliance evidence without requiring analysts to manually build and upload reports. It produces a consistent report for each device and assigns the completed evidence to the relevant compliance controls.

This automation receives a domain from a webhook, adds it to a security blocklist, and reports whether the action succeeded or failed. It removes the need to manually update the blocklist and notify the appropriate security audience.

This automation receives an email-based request to block a domain, verifies that a domain value was provided, and routes valid requests to the configured domain-blocking action in FireEye Endpoint Security. Requests without a domain are completed without invoking the blocking step.

This automation scans for domain-related breach findings, determines whether compromised accounts require remediation, updates affected directory users with a newly generated hashed password, and sends the breach details to a channel. If no breach is found, the workflow completes with a no-breach result.

This automation monitors downloaded files reported by endpoint security, retrieves the relevant user, device, and file details, and checks the file against multiple malware intelligence sources. It delivers a curated security alert to the SOC with related case information and analyst-approved remediation actions.

This automation turns an EDR alert into a structured incident case, enriches it with file, IP, computer, and user context, and routes the result according to whether the alert is suspicious. Suspicious alerts are shared with the security team, while non-suspicious cases are documented and closed.

This automation investigates reported email attachments by retrieving the related message, downloading and unpacking the attachment, and checking its file hash in VirusTotal. It produces structured triage data and security-enrichment results for follow-up analysis.

This automation configures multiple email accounts for forwarding by applying POP, IMAP, forwarding-address, and auto-forwarding settings in sequence. It replaces repeated account-by-account setup with a consistent, token-based process that leaves messages in the inbox while enabling forwarding.

This automation enriches submitted email addresses, domains or URLs, and attachments by comparing them with internal trusted and whitelisted reference lists. It returns a branch-specific assessment to the calling workflow, helping analysts identify trusted values and isolate URLs that are not on the approved list.

This automation turns an onboarding email into a coordinated employee setup across identity, access, collaboration, and team-specific tools. It creates the core accounts, assigns access based on the employee's role, reports the completed setup to the onboarding owner, and optionally sends the new employee a welcome email with a temporary password.

This automation performs a monthly inventory of applications installed on employees' devices, excludes Apple default applications, and records the remaining software details in a spreadsheet. It then notifies the relevant operations channel that the monitoring report is available for review or follow-up.

This automation runs a daily employee compliance review, checks each person against defined security and compliance requirements, and identifies specific failures. When non-compliant employees are found, it sends a clear alert with the failed checks to a Slack channel; otherwise, the run completes without sending a message.

This automation scans active employee email accounts for known data breaches on a schedule or through an individual account request, compares findings with historical records, and remediates newly exposed accounts. It records breach details, signs affected users out, forces a password change, and delivers targeted Slack notifications and reports.

Automates employee offboarding by identifying recently changed employee records, checking whether offboarding is due today, removing qualifying users from Slack, suspending their Google Workspace and Okta access, and sending a detailed status email. This replaces a multi-system manual checklist with a consistent automated sequence.

This automation turns an authorized onboarding request into a coordinated employee setup process. It collects the new hire's details, creates their company account and group membership, sends credentials and welcome instructions, and notifies the onboarding team.

Automates employee-behavior investigations by gathering account activity, connection and IP evidence, breach information, and location context, then producing a structured security assessment and Slack handoff. It replaces scattered lookups with a repeatable triage path, although the configured test values and branch logic should be validated before production use.

This automation identifies a target computer managed by Check Point Harmony Endpoint, submits a restart job, and monitors both the lookup and restart operations until they are complete. It returns the computer owner, computer ID, job status, and timestamp to the parent workflow without requiring an operator to manage the endpoint portal manually.

This automation monitors newly enrolled Jamf devices to verify that CrowdStrike recognizes them. It posts the enrollment status to a designated Slack channel, confirms successful detection, or alerts the IT team if the device remains undetected after approximately one hour.

This automation receives a request to investigate endpoint security information and uses an AI agent to reason across endpoint visibility, agents, indicators of compromise, and threats. It returns a consolidated result describing the investigation and actions taken, reducing the need for analysts to perform separate security-console lookups.

This automation ingests Exchange audit events, filters out service noise and non-relevant operations, and analyzes qualifying user activity such as message sends, deletions, mailbox changes, and inbox-rule creation. It creates a contextualized Teams incident alert with event details and interactive next-step controls for locking an account, asking the user, or closing the alert.

This automation scans a configured list of IP addresses for exposed ports, identifies the services and protocols associated with any findings, and posts a consolidated report to a Slack channel. It replaces repeated lookups and manual report assembly with a scheduled, repeatable port-visibility check.

This automation performs a scheduled external attack surface assessment for a domain by enumerating subdomains, checking DNS and email security configuration, and examining publicly exposed infrastructure. It consolidates the findings into a structured markdown report with risk analysis, a TL;DR, and follow-up actions.

This automation processes suspected false-positive security alerts, identifies their source, and applies the appropriate host, user, or file exception. It can also add approved file hashes to an allowed list and close eligible alerts as false positives, reducing repetitive analyst handling.

This automation monitors file-visibility change events and identifies documents made accessible to anyone with the link, especially when their titles contain sensitive or business-critical terms. It alerts the Security team with the document context and provides an interactive path to reset the file to private, record the outcome, and close the case.

This automation initiates firmware upgrades for a designated list of firewalls, checks the result of each equipment upgrade, and tracks failures. After processing the list, it sends the team a summary of the upgrade results.

This automation handles first-level customer interactions on vulnerability tickets received from Jira Service Management or ServiceNow. It retrieves the relevant ticket context, answers routine requests when possible, escalates uncertain cases to the VOC team, and records the resulting customer response and internal activity on the ticket.

This automation captures new form responses and appends their submitted values to a spreadsheet automatically. It replaces recurring manual data entry with a consistent, centralized record of incoming responses.

Automate granting backup verification codes when employees lose their 2FA access. It leverages Slack for notifications and decision-making while integrating with Google Admin Directory to retrieve and distribute new codes, enhancing security response times and user support efficiency.

Automates account enrichment by checking whether an account requires processing, gathering available username and account information from connected identity directories, and resolving the user's manager details. The workflow applies domain-aware lookup logic and stores the manager email for downstream use before completing the process.

This scheduled automation identifies inactive IAM users by reviewing login and account-age information, then routes qualifying accounts through administrative approval and activity investigation. Approved accounts are documented in Jira, checked in CloudTrail, and deleted from IAM.

This automation reviews AWS IAM users for inactivity, checks account age and recent activity, and routes potentially dormant accounts through administrator approval. Confirmed concerning accounts generate an investigation issue, receive a CloudTrail review, and are then deleted from IAM.

This automation receives a security incident, checks for duplicates and related incidents, and uses automated triage to determine the appropriate response path. It creates a structured incident record with remediation tasks and correlation links when investigation is required, while avoiding duplicate ticket creation.

This automation receives PagerDuty incident webhooks, determines the incident type, and enriches relevant incidents with incident, user, IP reputation, and geolocation information. It documents the findings in PagerDuty and, for the applicable acknowledgment path, posts a status update and creates a trouble ticket for continued tracking.

This automation monitors recent Okta sign-in events and identifies users with more than four failed login attempts. It creates a PagerDuty alert, notifies the SOC in Slack, and lets an analyst acknowledge or close the alert from Slack.

This automation screens incoming invoice-related emails, protects sensitive information, extracts invoice details, and checks them against supplier records. Emails that do not match known invoices are routed for human approval, with denied messages automatically removed and security notified.

This automation enriches a medium-severity security alert by investigating indicators, alerts, detects, and device telemetry across the environment. It delivers a concise triage summary showing how widely a hash has executed, details for the primary host, and a recommendation on whether the activity is a widespread false positive or an isolated anomaly.

This automation monitors a US-CERT alert feed, extracts potential indicators of compromise, enriches domains and IP addresses with security intelligence, and prepares a review email with links for human-approved blocking. It replaces repeated indicator lookups and report preparation with a structured review workflow.

Automates the analysis of unknown Indicators of Compromise by identifying whether each item is a hash, domain, URL, or IP address and sending it to the appropriate threat-intelligence lookup. The workflow returns structured threat context such as risk, sightings, related entities, and threat-list information so security teams can assess indicators more consistently.

This automation enriches URLs and email attachments that are not resolved by internal threat intelligence checks by analyzing them against external intelligence and classifying them as malicious or non-malicious. It updates internal allowlists or blocklists and returns a Boolean result to the originating workflow.

This automation runs a configured Snowflake query, extracts IPv4 addresses, checks IP reputation through two threat-intelligence services, and records an asset-ownership note on a Zendesk ticket. It replaces the repeated handoff between data retrieval, reputation lookups, and ticket updates with one chained workflow.

This automation reviews an IPA submission against handbooks, corporate standards, and an architecture diagram, then consolidates the findings into a structured compliance assessment. It replaces document-by-document comparison and manual report writing with an automated, traceable review delivered by email.

This automation accepts an array of IP addresses, filters for IPv4 addresses, and enriches each one with threat intelligence from VirusTotal Enterprise. It identifies malicious findings and sends an email report containing the IP, malicious status, and reputation details.

This automation retrieves issues from a security platform, collects the evidence associated with each issue, and sends the available evidence to Splunk as audit events. It replaces repeated issue-by-issue retrieval and forwarding with a controlled, evidence-aware ingestion process.

This automation manages just-in-time access to sensitive cloud resources by translating an authorized Slack request into temporary account permissions. It grants the selected access for a defined period, automatically revokes it afterward, and keeps the requester and team informed through Slack.

This automation analyzes every newly received email for suspicious sender infrastructure, URLs, and attachments, then removes confirmed malicious messages and alerts the security team. It solves the need for manual cross-tool investigation while preserving a human decision point for scanning other employee mailboxes.

This scheduled automation retrieves the latest active malicious hostnames from a threat intelligence feed, formats them, and replaces the firewall's hostname blacklist with the refreshed set. It removes the need for analysts to download, extract, reformat, and apply blacklist updates manually.

This workflow retrieves high- and critical-severity open Wiz findings, identifies virtual-machine malware issues, and creates Jira tickets with the relevant investigation details. When a matching SentinelOne agent is found, it gathers artifacts, presents remediation or ignore options, and can disconnect the affected host from the network when remediation is selected.

This automation retrieves an email attachment from a user's mailbox, converts it for analysis, and checks whether it contains malware. Malicious attachments are deleted and the associated user is notified in Slack, while clean files complete successfully.

This automation turns a scheduling request sent through a webhook into a booked meeting by identifying the requested attendees, checking their calendar conflicts, and selecting the earliest qualifying slot. It then creates the meeting on the organizer's calendar and retrieves the resulting event details.

This automation detects updates to monitored Google Meet recording folders, retrieves the relevant transcript or chat content, and generates a structured meeting summary with the title and attendee details. It then delivers the summary directly to each internal attendee through Slack, eliminating the need to prepare and distribute meeting notes manually.

This automation coordinates sequential refreshes for dependent mother and daughter dataflows or datasets across one or more workspaces. It refreshes permissions, starts the mother refresh, waits until it is completed, and then triggers the daughter refresh.

This automation analyzes a submitted list of indicators of compromise using VirusTotal and produces a consolidated summary. It replaces repeated individual IOC reviews with one structured analysis result for the requesting process or analyst.

This scheduled automation gathers user access, administrative status, authentication, device, and membership details from multiple business systems, then consolidates them into a structured access review report. It formats, exports, and uploads the report as compliance evidence to the configured controls.

This automation periodically searches a defined network across selected ports to identify exposed products and their detected versions. It organizes the findings, including ports without a reported version, into a spreadsheet-based network inventory for security review.

This automation turns supplied new-user details into an enabled Microsoft 365 account with department, title, and licensing configured, then creates a Jira issue and sends a Teams notification. It replaces the repeated account setup, licensing, ticket creation, recipient lookup, and notification steps with one connected workflow.