SECOPS
Audit-anomaly ledger to Postgres with Linear follow-up
Streams flagged audit anomalies into a Postgres ledger for durable history and trend queries.
How it runs
The automated pipeline, trigger to output.
- TriggerFlagged-anomaly webhook receivedHTTP webhook
- LogicNormalize payload into ledger row
- ActionInsert anomaly into Postgres ledgerPostgres
- LogicBranch: severity high or critical?
- OutputCreate Linear issue for high-severity findingLinear
What it does
It captures every flagged audit anomaly, writes it to a Postgres table as a permanent, queryable record, and for high-severity items spins up a tracked Linear issue — so anomalies are both retained for trend analysis and actioned with clear ownership.
When to use it
Choose this when ephemeral Slack pings aren't enough and you need an auditable backing store plus accountable follow-through. Good for teams that report on anomaly volume over time and must show that serious findings were triaged to closure.
How it works
- 1A webhook receives a flagged anomaly from your detector or another Hive workflow.
- 2A normalize step shapes the payload into a consistent ledger row (actor, source, action, severity, raw detail).
- 3The row is inserted into the Postgres anomaly ledger for durable history.
- 4A decision step checks whether severity is high or critical.
- 5If below threshold, the run ends with the ledger entry only.
- 6If high, a Linear issue is created with the anomaly details and a security label so it enters the triage board with an owner.
Set it up
What you configure once, before turning it on.
- 1Connect HTTP webhookTrigger any URL on agent actions.
- 2Connect PostgresAny Postgres URL — query, write, migrate.
- 3Connect LinearIssues, projects, cycles, triage.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Page on-call when a WAF rule mass-blocks legitimate traffic
On demand or every few minutes, it detects a single Cloudflare WAF rule suddenly blocking a broad spread of ASNs and paths (a likely false-positive storm).
PII Content Scan on New Dropbox External Share
When a file gets an external Dropbox link, it reads the file content, uses an AI classifier to detect PII or secrets.
Compile a weekly WAF tuning review with trends to Confluence
Every week an agent rolls up Cloudflare WAF block clusters by rule and ASN, compares them to prior weeks for trend direction.
Sensitive Dropbox Link Owner Remediation Loop
When a newly created Dropbox shared link points to a sensitive file, this workflow DMs the file owner, gives them a deadline to justify or revoke it.
GitLab Push Secret Detection to Block and History Purge
On a GitLab push that contains a detected secret, it revokes the exposed credential, opens a tracking issue with git-history purge instructions.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.