This workflow template, "Validate Gem Alert Events in Slack," is designed for security incident validation. It initiates when a promising alert is flagged by Gem Security Monitoring. The workflow extracts the list of triggering events, sends them to the involved user via Slack, and requests validation to confirm whether they performed those actions. Once the user's acknowledgment is collected, it gets added to the alert's timeline within Gem, creating a clear record of the validation process for security teams.
Trigger
Gem
Use Cases
CSPM
Workflow Breakdown
Extract the list of triggering events from the alert's timeline
Send the events list to the relevant user in Slack, and validate they're the ones who actually performed them
Add the user's Slack response to the alert's timeline in Gem
Vendors
Slack, Utils, Gem