IT OPS
Correlate Expense and DNS Signals into a Shadow-IT Risk Score
Joins SaaS charges from Snowflake with first-seen domains from Cloudflare DNS to confirm real shadow-IT adoption, scores each tool by spend and reach.
How it runs
The automated pipeline, trigger to output.
- TriggerWeekly correlation schedule
- ActionQuery unsanctioned SaaS chargesSnowflake
- ActionPull first-seen SaaS DNS domainsCloudflare
- LogicJoin signals and compute risk score
- ActionOpen ranked Linear intake issueLinear
- OutputPost prioritized digest to SlackSlack
What it does
Combines two independent signals — money leaving on cards and traffic leaving on the network — so a SaaS tool that shows up in both is treated as a confirmed, higher-confidence shadow-IT finding rather than a noisy single-source alert.
When to use it
Run it weekly when you have both Snowflake expense data and Cloudflare DNS logs and want to cut false positives, focusing security review time on tools that are both paid for and actively used.
How it works
- 1A weekly schedule starts the correlation run.
- 2A Snowflake query returns unsanctioned SaaS charges; a Cloudflare action returns first-seen SaaS domains for the same window.
- 3A logic step joins the two by vendor/domain and computes a risk score from monthly spend and the number of distinct users resolving the domain.
- 4Findings above the threshold open a Linear issue ranked by score, with both spend and usage evidence attached.
- 5A Slack summary lists the week's confirmed shadow-IT tools in priority order.
Set it up
What you configure once, before turning it on.
- 1Connect SnowflakeWarehouses, queries, shares.
- 2Connect CloudflareWorkers, Pages, R2, KV — the edge stack.
- 3Connect LinearIssues, projects, cycles, triage.
- 4Connect SlackChannels, DMs, threads, mentions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More IT Ops workflows
Recurring Sensor Fault Root-Cause Investigator
On a schedule, an agent reviews recent Monday work orders and BigQuery telemetry to identify equipment with repeating faults, drafts a root-cause hypothesis with a recommended fix.
Daily Building Anomaly Digest to MS Teams
Each morning queries BigQuery for the prior day's flagged sensor anomalies, summarizes them by site and system into a ranked briefing.
Agentic Inactive-Seat Reclamation Review
An agent investigates each idle SaaS seat by correlating SSO login gaps with HR status and ticket history, classifies it as reclaim, hold, or escalate, and drafts a reasoned…
Reconcile SSO logins against expense spend to find unmanaged tools
Joins SSO usage data with expense/payment records in Snowflake to surface tools that are being used but not paid for, or paid for but never logged.
Approved-Seat Deprovision Execution
Fires when an IT approver confirms a seat for removal, then executes deprovisioning via the IdP API and logs the action to an audit table and a Linear cleanup ticket.
HVAC Anomaly Detection to Severity-Routed Work Orders
Ingests building HVAC telemetry via webhook, flags out-of-band temperature, pressure, or runtime readings.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.