IT OPS
Auto-Enrich a Shadow-IT Finding with Vendor Risk Research
When a new shadow-IT Linear issue is created, an agent researches the vendor's security posture and data practices on the web, writes a risk brief into the issue.
How it runs
The automated pipeline, trigger to output.
- TriggerNew shadow-IT intake issue in LinearLinear
- ActionResearch vendor security postureExa
- ActionCompose risk brief and assign tierOpenAI
- LogicBranch on risk tier
- ActionWrite brief back to the issueLinear
- OutputAlert security on high-risk toolsSlack
What it does
Takes a freshly filed shadow-IT intake ticket and does the analyst's first hour of work automatically: it researches the SaaS vendor, summarizes what data the tool touches, whether it offers SSO and a SOC 2, and any known breaches, then drops a structured risk brief onto the ticket.
When to use it
Use it downstream of any shadow-IT detector when your security team wants every intake ticket pre-loaded with vendor context so the human review starts from a decision, not a blank page.
How it works
- 1A new issue in the Linear Security Intake project triggers the flow.
- 2An agent uses web search to gather the vendor's security, compliance, and data-handling posture.
- 3An OpenAI step composes a structured risk brief and assigns a preliminary risk tier.
- 4A logic step branches on the tier, escalating high-risk findings.
- 5The brief and tier are written back as a Linear comment, and high-risk tools trigger a Slack alert to the security channel.
Set it up
What you configure once, before turning it on.
- 1Connect LinearIssues, projects, cycles, triage.
- 2Connect ExaNeural search across the web.
- 3Connect OpenAIModels, embeddings, files.
- 4Connect SlackChannels, DMs, threads, mentions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More IT Ops workflows
Recurring Sensor Fault Root-Cause Investigator
On a schedule, an agent reviews recent Monday work orders and BigQuery telemetry to identify equipment with repeating faults, drafts a root-cause hypothesis with a recommended fix.
Daily Building Anomaly Digest to MS Teams
Each morning queries BigQuery for the prior day's flagged sensor anomalies, summarizes them by site and system into a ranked briefing.
Agentic Inactive-Seat Reclamation Review
An agent investigates each idle SaaS seat by correlating SSO login gaps with HR status and ticket history, classifies it as reclaim, hold, or escalate, and drafts a reasoned…
Reconcile SSO logins against expense spend to find unmanaged tools
Joins SSO usage data with expense/payment records in Snowflake to surface tools that are being used but not paid for, or paid for but never logged.
Approved-Seat Deprovision Execution
Fires when an IT approver confirms a seat for removal, then executes deprovisioning via the IdP API and logs the action to an audit table and a Linear cleanup ticket.
HVAC Anomaly Detection to Severity-Routed Work Orders
Ingests building HVAC telemetry via webhook, flags out-of-band temperature, pressure, or runtime readings.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.