SECOPS
Impossible-Travel Login Detector with Evidence Packet
Watches Axiom auth logs for the same user authenticating from two geographically distant locations within an impossible time window.
How it runs
The automated pipeline, trigger to output.
- TriggerNew auth events arrive in AxiomAxiom
- ActionGeolocate each login source IP
- LogicFlag pairs exceeding plausible travel speed
- ActionAssemble geolocated evidence packet
- ActionOpen Linear security incident with packetLinear
- OutputPost alert linking the incident to SlackSlack
What it does
Detects "impossible travel" sign-ins: when one identity logs in from two places that no human could traverse in the elapsed time (e.g. New York then Singapore eleven minutes later). It builds a structured evidence packet and opens a tracked incident so an analyst can act fast.
When to use it
Run this continuously when you ship a SaaS or internal app and want account-takeover signal without buying a full ITDR suite. Best when your auth events already land in Axiom with IP, user ID, and timestamp.
How it works
- 1Axiom emits a batch of new authentication events on a short polling interval.
- 2The workflow groups successful logins per user and geolocates each source IP.
- 3A logic step computes the required travel speed between consecutive logins; if it exceeds a plausible-travel threshold, the pair is flagged.
- 4For each flag it assembles an evidence packet — both IPs, ASN/org, device fingerprints, the two raw events, and a map of distance vs. time.
- 5It creates a Linear issue in the Security team with the packet attached and a severity label.
- 6It posts a concise alert to the secops Slack channel linking the Linear issue.
Set it up
What you configure once, before turning it on.
- 1Connect AxiomLog streams, queries, dashboards.
- 2Connect LinearIssues, projects, cycles, triage.
- 3Connect SlackChannels, DMs, threads, mentions.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Page on-call when a WAF rule mass-blocks legitimate traffic
On demand or every few minutes, it detects a single Cloudflare WAF rule suddenly blocking a broad spread of ASNs and paths (a likely false-positive storm).
PII Content Scan on New Dropbox External Share
When a file gets an external Dropbox link, it reads the file content, uses an AI classifier to detect PII or secrets.
Compile a weekly WAF tuning review with trends to Confluence
Every week an agent rolls up Cloudflare WAF block clusters by rule and ASN, compares them to prior weeks for trend direction.
Sensitive Dropbox Link Owner Remediation Loop
When a newly created Dropbox shared link points to a sensitive file, this workflow DMs the file owner, gives them a deadline to justify or revoke it.
GitLab Push Secret Detection to Block and History Purge
On a GitLab push that contains a detected secret, it revokes the exposed credential, opens a tracking issue with git-history purge instructions.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.