Auto-triage Elastic alerts and block malicious IPs
Build a workflow triggered by Elastic Security alerts containing source IPs. Enrich each IP with GreyNoise to assess maliciousness. If malicious, add a deny rule in Google Cloud Firewall and create/update a Tines Case with the details; post a Slack notification either way. Deduplicate repeat IPs, skip known-good/allowlisted addresses, and retry API failures. Output the verdict, any block applied, and the case reference.
What this prompt builds
Enrich Elastic IP alerts with GreyNoise, block confirmed-malicious IPs in Google Firewall, and track it in Cases.
The problem
SOC analysts spend their day manually enriching IP alerts and copying indicators into firewalls, which is slow and inconsistent under volume. Malicious IPs stay reachable while triage queues build up.
Solution and impact
This workflow enriches each Elastic alert's IP with GreyNoise, blocks confirmed-malicious addresses via Google Cloud Firewall, and logs everything in Tines Cases with Slack updates. Containment time drops from hours to seconds and every action is recorded.