SECOPS
JIT Privileged-Grant Anomaly Review from Axiom Audit Logs
Watches Axiom for new privileged-role grants, scores each against baseline behavior with an LLM, and posts high-risk grants to Slack with one-click approve or revoke actions.
How it runs
The automated pipeline, trigger to output.
- TriggerScheduled poll of Axiom privileged-grant eventsAxiom
- ActionScore grant risk with LLM against grant historyOpenAI
- LogicBranch: auto-resolve low risk, escalate the rest
- ActionPost interactive review card to SlackSlack
- OutputRecord reviewer decision back to Axiom via webhookHTTP webhook
What it does
It continuously reviews newly issued privileged role grants (admin, owner, break-glass) recorded in your Axiom audit dataset and surfaces only the ones that look anomalous, so your security team isn't drowning in routine access noise.
When to use it
Use this when privileged access is granted frequently across cloud, SaaS, and internal tools, and you want a just-in-time review loop without manually scanning every entry. Ideal for teams enforcing least-privilege who need an audit trail of who reviewed each grant.
How it works
- 1A scheduled run queries Axiom for privileged-grant events since the last checkpoint.
- 2For each grant, an OpenAI model scores risk using the grantee, role, time of day, whether the grantor is the grantee, and prior grant history pulled from the same dataset.
- 3A logic branch splits grants: low risk auto-resolves with a logged note; medium and high risk continue.
- 4Slack receives an interactive message per flagged grant with Approve, Revoke, and Escalate buttons plus the model's reasoning.
- 5A webhook callback records the reviewer's decision back to Axiom as a structured review event for compliance.
Set it up
What you configure once, before turning it on.
- 1Connect AxiomLog streams, queries, dashboards.
- 2Connect OpenAIModels, embeddings, files.
- 3Connect SlackChannels, DMs, threads, mentions.
- 4Connect HTTP webhookTrigger any URL on agent actions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Scheduled AWS Access-Key Age Sweep and Forced Rotation
Runs daily to find IAM access keys older than your policy threshold, deactivates the stale key, issues a fresh pair, and notifies the key owner with their replacement instructions.
Correlate Datadog WAF anomaly alert with Cloudflare evidence
When Datadog fires a WAF block-rate anomaly monitor, it pulls the matching Cloudflare firewall events, builds an evidence pack of top rules and ASNs.
Exposed-Secret Incident Triage and Remediation Agent
An agent-driven workflow that investigates a reported leaked secret end to end, decides revoke-versus-escalate, executes the rotation.
Non-Rotatable Leaked Secret to PagerDuty Escalation
Catches secret-scan hits for credentials that cannot be auto-rotated, gathers blast-radius context, and pages the on-call engineer with a step-by-step manual rotation runbook.
GitHub Secret-Scan Hit to Auto-Revoke and Rotate
When GitHub secret scanning flags a leaked credential in a repo, it auto-classifies the secret type, revokes the live key at the provider, mints a replacement.
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.