IT & Security package

Security alert enrichment

SIEM alerts are enriched with IP reputation, user and asset context, then auto-closed, opened as a SOAR case, or contained after analyst approval.

Headless / APIAdvanced~20 min setupv1.0.0
Download .utpkg 19 KBHow to install

About this package

What it does

Security alert enrichment does the first ten minutes of triage for every SIEM alert. The SIEM posts the alert (id, rule name, source IP, username, hostname and severity) to the workflow's webhook or start API.

The workflow looks up the source IP in your threat-intelligence service, the user in the directory (department, privileged roles, MFA) and the host in the CMDB (criticality, owner, environment, EDR agent id). Lookups continue on error, so a missing user or unknown host does not stop triage. The Alert disposition decision table weighs the IP score, asset criticality, privileged user and severity and chooses auto-close, investigate or contain.

Benign alerts are closed in the SIEM with the enrichment as a comment. Alerts to investigate become a SOAR case with the observables attached, and the alert is linked to the case. Containment needs a person: the on-shift analyst approves host isolation within 30 minutes (escalating to the SOC lead), the EDR isolates the host and a case is opened either way. Adapt the disposition thresholds and the five API paths.

Headless / API

Headless: the SIEM posts each alert to the inbound webhook or the start API. People only see a task when an alert needs containment.

Another system starts it over REST or an inbound webhook. No UI is needed; people only appear where a decision needs a human.

The flow

Step by step

  1. 1

    Alert received

    The SIEM posts the alert id, rule name, source IP, username, hostname and severity.

  2. 2

    Enrich

    IP reputation, Get user and Get asset add the threat score and categories, the user's department and privileged status, and the host's criticality, owner and EDR id.

  3. 3

    Decide the disposition

    The Alert disposition decision table chooses auto-close, investigate or contain, with a case severity and reason.

  4. 4

    Auto-close or investigate

    Benign alerts are closed in the SIEM with the enrichment. Others become a SOAR case and the alert is linked to it.

  5. 5

    Contain with approval

    For contain, the analyst approves host isolation within 30 minutes (or it escalates), the EDR isolates the host and a case is opened.

Security alert enrichment — The SIEM posts an alert; the workflow enriches it with IP reputation, the user and the asset, decides a disposition, and closes it, opens a SOAR case, or isolates the host after analyst approval. The same canvas you get in the designer after installing.

Forms

Inputs and task forms

The inputs a caller passes when it starts a run, and the forms people complete when the process needs a decision.

Start inputs

Security alert enrichment

Passed by the calling system

Alert id * alert_id · textSIEM alert id
Rule name * rule_name · textDetection rule that fired, e.g. "Impossible travel sign-in"
Source ip * source_ip · textSource IP address in the alert
Username username · textAccount in the alert (directory username)
Hostname hostname · textHost in the alert (CMDB hostname)
Severity * severity · select
lowmediumhighcritical
SIEM severity: low, medium, high or critical
Analyst user id analyst_user_id · textOptional: user id of the on-shift analyst who approves containment (falls back to the default chosen on install)

User Task

Approve host isolation

Isolate {{hostname}}? {{rule_name}} ({{username}})

Analyst notes * analyst_notes · text
Asset owner informed notify_owner · boolean
Isolate hostDo not isolate

Headless

Call it from your systems

Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.

REST

shell
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
  -H "Authorization: Bearer $USERTASKS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"workflow_id":"<workflow id>","variables":{"alert_id":"ALR-559102","rule_name":"Multiple failed sign-ins followed by success","source_ip":"203.0.113.45","username":"d.whitfield","hostname":"fin-ws-0417","severity":"high"}}'

CLI

shell
usertasks workflows inputs <workflow id>          # the start form: keys, types, required
usertasks workflows run <workflow id> --input alert_id=ALR-559102 --input rule_name="Multiple failed sign-ins followed by success" --input source_ip=203.0.113.45 --input username=d.whitfield … --wait

Inbound webhook

shell
usertasks webhooks create <workflow id>          # prints the hook slug and secret once
curl -X POST "$USERTASKS_URL/api/webhooks/inbound?hook=<slug>" \
  -H "Authorization: Bearer <webhook secret>" -H "Content-Type: application/json" \
  -d '{"alert_id":"ALR-559102","rule_name":"Multiple failed sign-ins followed by success","source_ip":"203.0.113.45","username":"d.whitfield","hostname":"fin-ws-0417","severity":"high"}'

What's included

13 assets, ready to adapt

TypeNameDetails
IntegrationCMDB
IntegrationDirectory
IntegrationSecurity operations (SOAR / EDR)
IntegrationSIEM
IntegrationThreat intelligence
API referenceCreate casePOST /cases — Open an investigation case with the enrichment attached.
API referenceGet assetGET /assets/{{hostname}} — Configuration item for the host in the alert: business criticality, owner, environment and its EDR agent id.
API referenceGet userGET /users/{{username}} — Directory account for the username in the alert: department, privileged role membership and MFA status.
API referenceIP reputationGET /ip/{{ip}} — Reputation of an IP address: a 0-100 maliciousness score, categories and when it was last seen in threat feeds.
API referenceIsolate hostPOST /edr/hosts/{{host_id}}/isolate — Network-isolate a host through the EDR: only the EDR console can still reach it.
API referenceUpdate alertPATCH /alerts/{{alert_id}} — Set the alert status and add the enrichment summary as a comment.
Decision tableAlert disposition9 rules — What to do with an enriched alert, from the threat-intel score of the source IP, the asset criticality, whether the user is privileged and the SIEM severity. First matching rule wins.
WorkflowSecurity alert enrichment20 steps — The SIEM posts an alert; the workflow enriches it with IP reputation, the user and the asset, decides a disposition, and closes it, opens a SOAR case, or isolates the host after analyst approval.

Requirements

What you connect it to

Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.

Needs

  • REST API — A REST API integration: set its base URL and credentials on install.
  • Assignees — People in your workspace to receive the User Tasks (picked on install).
  • Inbound webhook — An inbound webhook created for the workflow, so other systems can start it.

After installing

  1. Threat intelligence integration: base URL and API key (sent as X-API-Key). IP reputation expects GET /ip/{ip} returning a 0-100 reputation_score and categories.
  2. Directory integration: base URL and token. Get user expects GET /users/{username} with department, privileged and mfa_enrolled.
  3. CMDB integration: base URL and token. Get asset expects GET /assets/{hostname} with criticality (low, medium, high, critical), owner and edr_host_id.
  4. SIEM integration: base URL and token for PATCH /alerts/{id}. Security operations integration: base URL and token for POST /cases and POST /edr/hosts/{id}/isolate.
  5. Assignees: pick the default SOC analyst who approves containment (alerts can pass analyst_user_id) and the SOC lead who receives escalations.
  6. Review the Alert disposition thresholds, then create an inbound webhook for the workflow and point your SIEM alert action at it.

Asked for on install

  • Integration “CMDB”Required

    • Tokenconfig.auth_config.token
    • Base urlconfig.base_urldefault https://cmdb.example.com/api· optional

  • Integration “Directory”Required

    • Tokenconfig.auth_config.token
    • Base urlconfig.base_urldefault https://directory.example.com/api· optional

  • Integration “Security operations (SOAR / EDR)”Required

    • Tokenconfig.auth_config.token
    • Base urlconfig.base_urldefault https://soar.example.com/api· optional

  • Integration “SIEM”Required

    • Tokenconfig.auth_config.token
    • Base urlconfig.base_urldefault https://siem.example.com/api· optional

  • Integration “Threat intelligence”Required

    • Key valueconfig.auth_config.key_value
    • Base urlconfig.base_urldefault https://threatintel.example.com/api· optional

  • Workflow “Security alert enrichment” assigneesRequired

    • User for step “Approve host isolation”nodes.16.config.assignee_id
    • User for step “Approve host isolation”nodes.16.config.escalation_user_id

Install

Install it in your workspace

Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.

In the app

  1. Download security-alert-enrichment-1.0.0.utpkg.
  2. Open Automations → Packages and drag the file onto the page (or choose Import package). Browse gallery there lists every gallery package without downloading by hand.
  3. Pick the file. The wizard verifies the checksum, every file hash and the signature, and shows the readme.
  4. Review the changes (what is created) and the data rows.
  5. Fill in the requirements, or tick Keep incomplete and finish later with Complete setup.
  6. Done: the workflow is published and active once setup is complete.

With the CLI

shell
curl -fLO https://usertasks.com/gallery/security-alert-enrichment-1.0.0.utpkg
usertasks packages inspect security-alert-enrichment-1.0.0.utpkg       # offline: checksum, hashes, signature
usertasks packages install security-alert-enrichment-1.0.0.utpkg --dry-run
usertasks packages install security-alert-enrichment-1.0.0.utpkg       # prompts for each requirement
usertasks packages install security-alert-enrichment-1.0.0.utpkg --keep-incomplete --yes   # in CI; finish with:
usertasks packages complete security-alert-enrichment -f values.yaml

Verify the download

File SHA-256
bcfc4e499d751123ff51cedf4a2d2a4a173f896ff950127ee132c39ed1d41144
Package checksum (what is signed)
sha256:fd163a144c6d5680fcd537e236710f9ab20567ef203bbf6ba78489827b3d830f
Signer
Unsigned preview build — compare the SHA-256 above

shasum -a 256 security-alert-enrichment-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.

Versions

Version 1.0.0

  1. v1.0.02026-10-26First release.

Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work

More packages

Related

Browse the whole gallery