This Torq workflow template automates the process of protecting an organization from high-level phishing threats. The daily scheduled workflow initiates by polling IntSights for phishing alerts. If any alerts are found, the workflow cross-references the domain with the CloudFlare Zero Trust block list. For new suspicious domains, it sends a message to a designated Slack channel requesting approval to block. Upon approval, the domain is added to the CloudFlare Zero Trust List, enhancing network security by preventing access to malicious sites. The completion of this action is then communicated back to the Slack channel.
Use Cases
Phishing, Remediate Network Security Alerts
Workflow Breakdown
Poll for high level Phishing events daily from IntSights
If alerts are found, check if the domain is already blocked in CloudFlare Zero Trust
Ask a Slack channel for approval to add domain to the CloudFlare Zero Trust List
If approved, notify the channel when complete
Vendors
Slack, Utils, VirusTotal, HTTP, IntSights
Workflow Output
Success/Failure via Slack
Tips
Modify the first \"set workflow variable\" step for your integrations and CloudFlare information