This workflow template streamlines the security checks for failed JumpCloud login attempts over a 24-hour period. It retrieves the failed attempts, clusters similar events based on the username and source IP, and then reaches out via Slack to confirm whether the failed access was a legitimate user attempt. If the user either does not recognize the activity or fails to respond, the workflow triggers the creation of an incident in ServiceNow. This proactive measure helps maintain the integrity of identity and access management within an organization.
Trigger
Scheduled Event
Use Cases
Identity and Access Management
Workflow Breakdown
Pull latest failed logins from JumpCloud from past 24 hours
Combine similar events based on username and source ip-address
Ask the user via Slack if they are the originator of the access attempt
If not confirmed or responded to, open a ServiceNow incident
Vendors
Slack, Utils, ServiceNow, JumpCloud
Tips
Jira or Zendesk could be used instead of ServiceNow if desired