SECOPS
OAuth Grant Blast-Radius Reviewer
When a new third-party OAuth app grant is detected, it scores the scope blast radius, posts a plain-English risk summary to Slack, and routes the grant for human approve or revoke.
How it runs
The automated pipeline, trigger to output.
- TriggerIdP audit webhook: new OAuth app grantHTTP webhook
- ActionLook up app grant historyPostgres
- ActionSummarize scopes and score blast radiusOpenAI
- LogicBranch: read-only vs. write/admin scopes
- OutputPost approve/revoke decision card to SlackSlack
What it does
Watches your identity provider's audit feed for newly authorized third-party OAuth apps. For each grant it expands the requested scopes into plain English, scores how much damage the app could do (read-only vs. full mailbox/drive/admin write), and posts an approve/revoke decision card to Slack so a security reviewer can act in seconds instead of digging through consent screens.
When to use it
Use this when employees can self-authorize SaaS apps against Google Workspace, Microsoft 365, or your SSO, and you need a lightweight review gate that catches over-permissioned or shadow-IT grants without blocking the whole org.
How it works
- 1A webhook from the IdP audit log fires whenever a new OAuth app is granted access.
- 2The flow looks up the prior grant history for that app from Postgres to flag first-time vs. known apps.
- 3An LLM step translates the raw scope strings into a readable summary and assigns a blast-radius tier.
- 4A logic branch separates low-risk read-only grants (auto-noted) from high-risk write/admin grants.
- 5A Slack message with Approve and Revoke buttons is posted to the secops channel, tagging the granting user.
Set it up
What you configure once, before turning it on.
- 1Connect HTTP webhookTrigger any URL on agent actions.
- 2Connect PostgresAny Postgres URL — query, write, migrate.
- 3Connect OpenAIModels, embeddings, files.
- 4Connect SlackChannels, DMs, threads, mentions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Scheduled AWS Access-Key Age Sweep and Forced Rotation
Runs daily to find IAM access keys older than your policy threshold, deactivates the stale key, issues a fresh pair, and notifies the key owner with their replacement instructions.
Correlate Datadog WAF anomaly alert with Cloudflare evidence
When Datadog fires a WAF block-rate anomaly monitor, it pulls the matching Cloudflare firewall events, builds an evidence pack of top rules and ASNs.
Exposed-Secret Incident Triage and Remediation Agent
An agent-driven workflow that investigates a reported leaked secret end to end, decides revoke-versus-escalate, executes the rotation.
Non-Rotatable Leaked Secret to PagerDuty Escalation
Catches secret-scan hits for credentials that cannot be auto-rotated, gathers blast-radius context, and pages the on-call engineer with a step-by-step manual rotation runbook.
GitHub Secret-Scan Hit to Auto-Revoke and Rotate
When GitHub secret scanning flags a leaked credential in a repo, it auto-classifies the secret type, revokes the live key at the provider, mints a replacement.
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.