Add user risk context to secret scanning alerts
When a new secret alert includes relevant IP signals, get a risk assessment to help decide whether further review is warranted.
Trigger
New Secret Scanning Alert Detected
Triggers when a new secret scanning alert is detected in a GitHub repository. Monitors open secret scanning alerts and fires an event for each newly detected alert. Supports filtering by secret type (e.g., personal access tokens, AWS keys) and by token validity status (active, inactive, unknown). The payload includes the alert number, secret type, validity status, resolution state, timestamps, URLs, and flags for push protection bypass, public exposure, and multi-repo detection.
Action
User Risk API
Tool to return a risk assessment for a user based on ip signals for fraud prevention. use after initial ip checks to decide whether to bypass or require captcha challenges.
Why this helps
A newly detected secret can demand urgent attention, while the surrounding IP context may be easy to overlook or slow to investigate.
- Surfaces an additional risk signal during secret alert review
- Helps prioritize follow-up using returned IP signals
- Keeps triage context with the automation run report
Setup
Build it in a few focused steps.
- 1Connect GitHub and Big data cloud once in the Notis portal.
- 2Create an automation in Automations, New Automation, and provide a name and prompt.
- 3Describe the outcome in one instruction: for each new secret scanning alert, assess user risk when the event provides the necessary IP signals and summarize the result.
- 4Pick the GitHub New Secret Scanning Alert Detected trigger and select a report channel.
- 5Test with one real alert that includes the needed IP signal data.
Questions about this workflow
Will the workflow invent missing IP details?
No. The user risk action needs IP signals. If the alert does not provide them, the automation can report that the necessary input is missing.
Does a high risk result automatically block anyone?
No. This workflow returns an assessment for review. The listed Big data cloud action does not perform account blocking or captcha challenges.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link GitHub to Big data cloud. A trigger fires from one place; an action lands in another.
GitHub triggers
Big data cloud actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Am I Roaming API
Tool to determine if the user is roaming based on their ip address and gps coordinates. use after obtaining device location to verify roaming status before mobile actions.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
ASN Extended Receiving From Info API
Tool to return upstream providers (receivingfrom) for a given asn. use when you need a paginated list of ases feeding traffic for the specified asn.
New Workflow Artifact Created
Triggers when a new workflow artifact is created in a GitHub repository. Monitors for newly created GitHub Actions workflow artifacts. Optionally filters by artifact name to restrict monitoring to specific artifacts.
ASN Extended Transit To Info API
Tool to return downstream customers (transitto) for a given asn. use when you need a paginated list of ases receiving traffic from a specific asn.
Branch Changed
Triggers when a GitHub branch changes. Monitors a specific branch for: - New commits pushed (head commit SHA changes) - Protection status toggled (branch becomes protected or unprotected) - Protection settings changed, including: required status checks and their enforcement level, admin enforcement, required pull request reviews (dismiss stale reviews, code owner reviews, approving review count, last push approval), required linear history, force push allowance, deletion allowance, conversation resolution, branch locking, and fork syncing.
ASN Rank List API
Tool to fetch a ranked list of autonomous systems by ipv4 announcement volumes. use after you need to compare or analyze as ranks.
New Branch Created
Triggers when a new branch is created in a GitHub repository. Detects newly created branches. Deleted branches do not fire events.
BGP Active Prefixes API
Tool to retrieve ipv4 or ipv6 prefixes currently announced on bgp. use when inspecting bgp routing announcements for a given asn.
Check Run Status / Conclusion Changed
Triggers when a specific GitHub check run changes its status or conclusion. Monitors a single check run for changes to: status (queued, in_progress, completed, etc.), conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required), started_at, and completed_at.
Reverse Geocoding With Timezone API
Tool to return reverse geocoding and time zone info for given coordinates. use when you need both locality details and timezone data in one call.
Check Suite Status / Conclusion Changed
Triggers when a GitHub check suite changes its status or conclusion for a given ref. Monitors all check suites associated with a git reference (branch, tag, or commit SHA) for changes to status (queued, in_progress, completed, etc.) and conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required, startup_failure, stale). Optionally filters by GitHub App ID.
Country by IP Address API
Tool to geolocate an ip address and retrieve country details and demographics. use when you need country-level data after obtaining the target ip address.
New Code Scanning Alert Created
Triggers when a new code scanning alert is created in a repository. Fires an event for each newly created code scanning alert detected in the configured repository. Alerts can be filtered by Git reference, scanning tool, state, and severity. The payload includes the alert number, rule details, tool information, state, severity, and the location of the most recent instance.
Country Info API
Tool to fetch detailed country information by iso code. use when you need localized names, currencies, regions, and other metadata for a country.
Connect any two apps with Notis in the middle.
GitHub and Big data cloud, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Big data cloud.