Skip to content
Notis

Turn an access alert into an investigation brief

Get the relevant activity, time range, and affected systems in one response.

Trigger

Webhook received

Notis starts this workflow when an external tool or custom backend sends an HTTP request.

Action

Execute ClickHouse Query

Execute a sql query in clickhouse and return the results. this is the primary action for querying data from clickhouse databases.

Why this helps

Incident response slows down when the alert, vault context, and activity data must be assembled manually.

  • Reduce investigation setup time
  • Focus on the affected service
  • Produce a readable activity summary

Setup

Build it in a few focused steps.

  • 1Connect 1Password and ClickHouse in the Notis portal.
  • 2Create an automation named Access Incident Investigation Query.
  • 3Tell Notis to query ClickHouse for activity tied to the webhook context and exclude passwords, tokens, and secret values.
  • 4Choose a webhook trigger and report destination.
  • 5Send one real incident payload and verify the investigation brief.

Questions about this workflow

What should the webhook include?

Include the service, time window, environment, and incident reference. Do not include secret values.

Can it prove who caused an incident?

It can summarize matching records. Attribution depends on the available ClickHouse fields and should be reviewed by a person.

When this happens · Trigger

Do this · Action

Supported Triggers and Actions

Notis builds workflows that link 1password to ClickHouse. A trigger fires from one place; an action lands in another.

1password triggers

ClickHouse actions

Recurring trigger

Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.

TriggerScheduled

Execute ClickHouse Query

Execute a sql query in clickhouse and return the results. this is the primary action for querying data from clickhouse databases.

ActionInstant

Webhook trigger

Notis starts this workflow when an external tool or custom backend sends an HTTP request.

TriggerInstant

Get Database Schema

Get comprehensive schema overview of an entire database including all tables and optionally their column definitions. essential for ai agents to understand the complete database structure in a single call.

ActionInstant

Get Table Schema

Get detailed schema information for a specific table including column definitions, types, keys, and optionally sample data. this is essential for ai agents to understand table structure before constructing queries.

ActionInstant

List ClickHouse Databases

List all databases in the clickhouse instance. useful for discovering available databases before querying tables.

ActionInstant

List ClickHouse Tables

List tables in clickhouse databases. returns information about tables including their engine, size, and row count.

ActionInstant

Connect any two apps with Notis in the middle.

1password and ClickHouse, or any other combination from 1,000+ integrations.

When this happens · Trigger

Do this · Action

Save your first hour today.

7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business ClickHouse.