Overview
This workflow automates the process of alerting users via Slack when a quarantined email is detected and escalates the incident by creating a Jira ticket if the email is opened. It integrates security alerts, user lookup, and ticketing to streamline incident response.
Key Features
- Webhook Integration: Receives security alerts from Sublime Security about quarantined emails.
- Conditional Logic: Checks if the quarantined email has been opened to determine escalation.
- Slack Notification: Looks up the user by email and sends a direct Slack notification if found.
- Jira Ticket Creation: Automatically creates a Jira Software ticket for opened quarantined emails, ensuring proper tracking and response.
- Fail-Safe Handling: Handles cases where users are not found or no action is needed, minimizing false positives.
Benefits
- Faster Incident Response: Immediate user notification and ticket creation reduce response times.
- Improved Security: Ensures that potential threats are escalated and tracked efficiently.
- Reduced Manual Work: Automates repetitive tasks, freeing up IT and security teams for higher-value work.
Use Cases
- IT Security Operations: For organizations needing real-time alerts and escalation for suspicious emails.
- Compliance and Audit: Ensures incidents are logged and tracked for regulatory requirements.
- Employee Awareness: Keeps users informed about security threats directly in their workflow.
Integrations
- Sublime Security, Slack, Jira Software: Seamless integration for end-to-end incident management.
