IT and security integrations and automations

What this work has in common

The work in this category is mostly controls, and a control that depends on somebody remembering to do it will eventually be missed. The designs in these guides follow the same pattern. Take the decision from an authoritative source such as the HRIS, the CMDB or the identity provider. Act with an expiry by default. Write down what happened as part of doing it.

The failures here are quiet. A licence nobody uses keeps renewing. A device assigned to a leaver is still listed against their name. An alert fires on a server that was decommissioned last quarter. None of these raise an error, so much of the work is reconciling what one system believes against what another one knows.

The usual systems are an ITSM such as ServiceNow or Jira Service Management, an identity provider such as Okta, device management such as Jamf or Intune, monitoring such as Datadog, a compliance platform such as Vanta, and Slack, where most requests and incidents start.

The guides cover access requests and approval, service desk fulfilment, incidents from declaration to postmortem, security alert triage, vulnerabilities into tickets, SaaS licence reclamation and device lifecycle.