Add a threat check to secret scanning alerts
Turn a worrying alert into a clear next investigation step.
Trigger
New Secret Scanning Alert Detected
Triggers when a new secret scanning alert is detected in a GitHub repository. Monitors open secret scanning alerts and fires an event for each newly detected alert. Supports filtering by secret type (e.g., personal access tokens, AWS keys) and by token validity status (active, inactive, unknown). The payload includes the alert number, secret type, validity status, resolution state, timestamps, URLs, and flags for push protection bypass, public exposure, and multi-repo detection.
Action
Security Threat Lookup
Tool to check if an IP address is associated with malicious activity, security threats, or appears on blocklists. Use when you need to assess IP reputation, detect VPN/proxy/Tor usage, identify bots or spam sources, or evaluate security risk for access control and fraud prevention.
Why this helps
Secret alerts create pressure, and it is easy to lose time deciding which infrastructure indicators to investigate first.
- Create a consistent first response
- Surface reputation concerns sooner
- Reduce decision fatigue during incidents
Setup
Build it in a few focused steps.
- 1Connect GitHub and Whoisfreaks to Notis once through the portal.
- 2Create the automation in the portal or ask Notis to create it in plain language.
- 3Use this instruction: When GitHub detects a new secret scanning alert, run a Whoisfreaks security threat lookup for any related IP or network indicator and summarize the risk context.
- 4Choose the secret scanning alert trigger, select the run-report channel, and test with one alert.
Questions about this workflow
What if the alert has no IP address?
Notis can report that no suitable IP indicator was available for the lookup.
Is this a full incident response workflow?
No. It is a focused threat-context check for the first triage step.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link GitHub to Whoisfreaks. A trigger fires from one place; an action lands in another.
GitHub triggers
Whoisfreaks actions
New Workflow Artifact Created
Triggers when a new workflow artifact is created in a GitHub repository. Monitors for newly created GitHub Actions workflow artifacts. Optionally filters by artifact name to restrict monitoring to specific artifacts.
ASN WHOIS Lookup
Tool to retrieve comprehensive ASN WHOIS information including ownership, network infrastructure, and IP address ranges. Use when you need to identify ASN ownership, organization details, or associated IP blocks for network administration or security analysis.
Branch Changed
Triggers when a GitHub branch changes. Monitors a specific branch for: - New commits pushed (head commit SHA changes) - Protection status toggled (branch becomes protected or unprotected) - Protection settings changed, including: required status checks and their enforcement level, admin enforcement, required pull request reviews (dismiss stale reviews, code owner reviews, approving review count, last push approval), required linear history, force push allowance, deletion allowance, conversation resolution, branch locking, and fork syncing.
Bulk DNS Lookup
Tool to process multiple domains or IPs simultaneously, returning all DNS records in a single request (max 100). Use when you need to retrieve DNS records for multiple domains at once for efficient batch processing.
New Branch Created
Triggers when a new branch is created in a GitHub repository. Detects newly created branches. Deleted branches do not fire events.
Bulk Domain Availability Check
Tool to check availability of multiple domains in one request (max 100 domains). Use when you need to verify if domain names are available for registration. Response time ranges from 16 seconds to 1 minute for 100 domains.
Check Run Status / Conclusion Changed
Triggers when a specific GitHub check run changes its status or conclusion. Monitors a single check run for changes to: status (queued, in_progress, completed, etc.), conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required), started_at, and completed_at.
Bulk WHOIS Lookup
Tool to query WHOIS information for up to 100 domains in a single request. Use when you need comprehensive registration details, contact information, name servers, and domain status for multiple domains. Response includes normalized and parsed WHOIS data with 1 credit charged per successful query for each domain.
Check Suite Status / Conclusion Changed
Triggers when a GitHub check suite changes its status or conclusion for a given ref. Monitors all check suites associated with a git reference (branch, tag, or commit SHA) for changes to status (queued, in_progress, completed, etc.) and conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required, startup_failure, stale). Optionally filters by GitHub App ID.
DNS Live Lookup
Tool to perform real-time DNS record resolution for network diagnostics and configuration verification. Use when you need to retrieve current DNS records for a domain or perform reverse DNS lookup for an IP address.
New Code Scanning Alert Created
Triggers when a new code scanning alert is created in a repository. Fires an event for each newly created code scanning alert detected in the configured repository. Alerts can be filtered by Git reference, scanning tool, state, and severity. The payload includes the alert number, rule details, tool information, state, severity, and the location of the most recent instance.
Check Domain Availability
Tool to check if a domain is available for registration with optional suggestions. Use when you need to verify domain availability or get alternative domain suggestions.
New Repository Collaborator Added
Triggers when a new collaborator is added to a GitHub repository. Monitors the full list of collaborators on a repository and fires an event for each newly added collaborator. The payload includes the collaborator's GitHub username, account ID, profile URL, avatar URL, permission flags (pull, triage, push, maintain, admin), and assigned role name.
Get Domain Files Status
Tool to check availability and update status of domain data files including newly registered, expired, and dropped domains. Use when you need to verify that domain data files are prepared and ready for download before accessing file download endpoints.
Commit Event
Triggered when a new commit is pushed to a repository.
IP Geolocation Lookup
Tool to retrieve geographic location information for an IP address including country, city, coordinates, ISP, and security details. Use when you need to identify the physical location of an IP, detect VPN/proxy usage, or gather network intelligence for security or analytics purposes.
Connect any two apps with Notis in the middle.
Not just GitHub and Whoisfreaks. Any combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7 days free trial with 20$ free usage included.
No card. Works with personal or business Whoisfreaks.