SECOPS
Investigate OAuth grants from unverified publishers
When an OAuth app from an unverified or unknown publisher is consented to, it enriches the app with web research on the vendor and posts an investigation brief so reviewers judge…
How it runs
The automated pipeline, trigger to output.
- TriggerUnverified-publisher grant receivedHTTP webhook
- LogicConfirm publisher is genuinely new
- ActionResearch publisher reputation on the webExa
- ActionDraft legitimacy brief with verdictOpenAI
- OutputPost investigation brief to security channelSlack
What it does
Focuses on the riskiest grant signal: apps from publishers your org has never seen or that are unverified by the identity platform. For each such grant it gathers open-source intelligence on the vendor (domain age, reputation, known incidents) and assembles a short legitimacy brief so a reviewer can decide whether the app is benign tooling or a phishing front.
When to use it
Use this when unverified-publisher consents are your top OAuth threat and you want enrichment done before a human looks. It saves analysts the manual vendor lookup and turns a bare app name into a decision-ready brief.
How it works
- 1A webhook receives a consent grant whose publisher is flagged unverified or absent from the allowlist.
- 2A logic step confirms the publisher is genuinely new versus a known-good vendor under an alias.
- 3A research action queries the web for the publisher domain, reputation signals, and any reported abuse.
- 4An agent step drafts a concise legitimacy brief with a recommended verdict.
- 5The final output posts the brief plus the raw grant details to the security channel for sign-off.
Set it up
What you configure once, before turning it on.
- 1Connect HTTP webhookTrigger any URL on agent actions.
- 2Connect ExaNeural search across the web.
- 3Connect OpenAIModels, embeddings, files.
- 4Connect SlackChannels, DMs, threads, mentions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Scheduled AWS Access-Key Age Sweep and Forced Rotation
Runs daily to find IAM access keys older than your policy threshold, deactivates the stale key, issues a fresh pair, and notifies the key owner with their replacement instructions.
Correlate Datadog WAF anomaly alert with Cloudflare evidence
When Datadog fires a WAF block-rate anomaly monitor, it pulls the matching Cloudflare firewall events, builds an evidence pack of top rules and ASNs.
Exposed-Secret Incident Triage and Remediation Agent
An agent-driven workflow that investigates a reported leaked secret end to end, decides revoke-versus-escalate, executes the rotation.
Non-Rotatable Leaked Secret to PagerDuty Escalation
Catches secret-scan hits for credentials that cannot be auto-rotated, gathers blast-radius context, and pages the on-call engineer with a step-by-step manual rotation runbook.
GitHub Secret-Scan Hit to Auto-Revoke and Rotate
When GitHub secret scanning flags a leaked credential in a repo, it auto-classifies the secret type, revokes the live key at the provider, mints a replacement.
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.