SECOPS
Weekly SBOM-vs-advisory drift digest to Confluence and Slack
Each week, reconciles your full SBOM against accumulated advisories and publishes a Confluence report of open exposures, newly-fixed items, and aging unpatched CVEs.
How it runs
The automated pipeline, trigger to output.
- TriggerWeekly schedule
- ActionFetch and parse SBOM from repoGitHub
- ActionMatch advisories to installed versionsHTTP webhook
- LogicCompute new, fixed, and SLA-aging deltas
- ActionPublish dated report to ConfluenceConfluence
- OutputPost digest summary to SlackSlack
What it does
Gives leadership and the security team a single recurring view of dependency-risk posture. It diffs the current SBOM against the advisory backlog, calculates what's newly exposed, what got patched since last week, and which CVEs are aging past SLA, then writes it up as a versioned Confluence page.
When to use it
Use it for weekly security reviews, compliance evidence, or audit trails where you need a durable, dated record of vulnerability posture rather than ephemeral alerts. Best for teams that document in Confluence and want a consistent cadence.
How it works
- 1A weekly schedule fires the run.
- 2The latest SBOM is fetched from the GitHub repo and parsed.
- 3An HTTP call pulls the active advisory set and matches affected ranges to installed versions.
- 4Logic computes deltas: new exposures, items fixed since last week, and CVEs past remediation SLA.
- 5A formatted report with tables and an aging chart is built.
- 6A Confluence page is published (new dated version) under the security space.
- 7A Slack summary posts the headline counts and a link to the page.
Set it up
What you configure once, before turning it on.
- 1Connect GitHubRepos, issues, pull requests, actions.
- 2Connect HTTP webhookTrigger any URL on agent actions.
- 3Connect ConfluenceSpaces, pages, blueprints.
- 4Connect SlackChannels, DMs, threads, mentions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Scheduled AWS Access-Key Age Sweep and Forced Rotation
Runs daily to find IAM access keys older than your policy threshold, deactivates the stale key, issues a fresh pair, and notifies the key owner with their replacement instructions.
Correlate Datadog WAF anomaly alert with Cloudflare evidence
When Datadog fires a WAF block-rate anomaly monitor, it pulls the matching Cloudflare firewall events, builds an evidence pack of top rules and ASNs.
Exposed-Secret Incident Triage and Remediation Agent
An agent-driven workflow that investigates a reported leaked secret end to end, decides revoke-versus-escalate, executes the rotation.
Non-Rotatable Leaked Secret to PagerDuty Escalation
Catches secret-scan hits for credentials that cannot be auto-rotated, gathers blast-radius context, and pages the on-call engineer with a step-by-step manual rotation runbook.
GitHub Secret-Scan Hit to Auto-Revoke and Rotate
When GitHub secret scanning flags a leaked credential in a repo, it auto-classifies the secret type, revokes the live key at the provider, mints a replacement.
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.