Overview
Build Torq workflows that triage alerts, consolidate cases, and contextualize observables to reduce Time-to-Respond (TTR).
How to use
Use Torq workflows to automate ingestion, consolidation, and investigation of suspicious activity alerts from Identity and Access Management (IAM) services like Okta.
The use case examples below cover alert ingestion, contextualization and pre-processing, observable enrichment and triage, and case assignment.
Ingest, contextualize and process IAM alerts
IAM alert trigger: Use events from an identity and access management service, such as Okta, to trigger a workflow.
Establish context: Retrieve the suspected user's group memberships to check whether the user is a VIP (power user with elevated privileges). VIP cases require urgent handling.
Consolidate events and cases: Use the Query cases step to check if there are existing cases for the user:
If cases exist, update the most recent one with new event details.
If no prior cases exist, create a new one, adding the user and the implicated IP address as observables.
Escalate if VIP: If the user is a VIP:
Increase the case severity.
Adjust the resolution SLA to reflect the increased urgency.
Notify key stakeholders promptly.
Enrich the observables: Automatically assign or close the case
New case trigger: Use the New case created trigger to run a workflow when the case is created.
Extract and enrich observables: Extract observables from the case and enrich them. In this example, the relevant observable is an IP address.
Escalate or resolve: Depending on the enrichment verdict.
If benign, update the case accordingly and resolve it.
If malicious, update the case with detailed findings, elevate severity, and update the case status to In Progress.
Case assignment and progression
Use the State changed trigger to run a workflow when the case state is updated to In Progress.
Assign the case to a team member selected from eligible assignees.
Notify the assigned team member and relevant stakeholders.
