Skip to content
Notis

Add a threat check to secret scanning alerts

Turn a worrying alert into a clear next investigation step.

Trigger

New Secret Scanning Alert Detected

Triggers when a new secret scanning alert is detected in a GitHub repository. Monitors open secret scanning alerts and fires an event for each newly detected alert. Supports filtering by secret type (e.g., personal access tokens, AWS keys) and by token validity status (active, inactive, unknown). The payload includes the alert number, secret type, validity status, resolution state, timestamps, URLs, and flags for push protection bypass, public exposure, and multi-repo detection.

Action

Security Threat Lookup

Tool to check if an IP address is associated with malicious activity, security threats, or appears on blocklists. Use when you need to assess IP reputation, detect VPN/proxy/Tor usage, identify bots or spam sources, or evaluate security risk for access control and fraud prevention.

Why this helps

Secret alerts create pressure, and it is easy to lose time deciding which infrastructure indicators to investigate first.

  • Create a consistent first response
  • Surface reputation concerns sooner
  • Reduce decision fatigue during incidents

Setup

Build it in a few focused steps.

  • 1Connect GitHub and Whoisfreaks to Notis once through the portal.
  • 2Create the automation in the portal or ask Notis to create it in plain language.
  • 3Use this instruction: When GitHub detects a new secret scanning alert, run a Whoisfreaks security threat lookup for any related IP or network indicator and summarize the risk context.
  • 4Choose the secret scanning alert trigger, select the run-report channel, and test with one alert.

Questions about this workflow

What if the alert has no IP address?

Notis can report that no suitable IP indicator was available for the lookup.

Is this a full incident response workflow?

No. It is a focused threat-context check for the first triage step.

When this happens · Trigger

Do this · Action

Supported Triggers and Actions

Notis builds workflows that link GitHub to Whoisfreaks. A trigger fires from one place; an action lands in another.

GitHub triggers

Whoisfreaks actions

New Workflow Artifact Created

Triggers when a new workflow artifact is created in a GitHub repository. Monitors for newly created GitHub Actions workflow artifacts. Optionally filters by artifact name to restrict monitoring to specific artifacts.

TriggerPolling

ASN WHOIS Lookup

Tool to retrieve comprehensive ASN WHOIS information including ownership, network infrastructure, and IP address ranges. Use when you need to identify ASN ownership, organization details, or associated IP blocks for network administration or security analysis.

ActionInstant

Branch Changed

Triggers when a GitHub branch changes. Monitors a specific branch for: - New commits pushed (head commit SHA changes) - Protection status toggled (branch becomes protected or unprotected) - Protection settings changed, including: required status checks and their enforcement level, admin enforcement, required pull request reviews (dismiss stale reviews, code owner reviews, approving review count, last push approval), required linear history, force push allowance, deletion allowance, conversation resolution, branch locking, and fork syncing.

TriggerPolling

Bulk DNS Lookup

Tool to process multiple domains or IPs simultaneously, returning all DNS records in a single request (max 100). Use when you need to retrieve DNS records for multiple domains at once for efficient batch processing.

ActionInstant

New Branch Created

Triggers when a new branch is created in a GitHub repository. Detects newly created branches. Deleted branches do not fire events.

TriggerPolling

Bulk Domain Availability Check

Tool to check availability of multiple domains in one request (max 100 domains). Use when you need to verify if domain names are available for registration. Response time ranges from 16 seconds to 1 minute for 100 domains.

ActionInstant

Check Run Status / Conclusion Changed

Triggers when a specific GitHub check run changes its status or conclusion. Monitors a single check run for changes to: status (queued, in_progress, completed, etc.), conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required), started_at, and completed_at.

TriggerPolling

Bulk WHOIS Lookup

Tool to query WHOIS information for up to 100 domains in a single request. Use when you need comprehensive registration details, contact information, name servers, and domain status for multiple domains. Response includes normalized and parsed WHOIS data with 1 credit charged per successful query for each domain.

ActionInstant

Check Suite Status / Conclusion Changed

Triggers when a GitHub check suite changes its status or conclusion for a given ref. Monitors all check suites associated with a git reference (branch, tag, or commit SHA) for changes to status (queued, in_progress, completed, etc.) and conclusion (success, failure, neutral, cancelled, skipped, timed_out, action_required, startup_failure, stale). Optionally filters by GitHub App ID.

TriggerPolling

DNS Live Lookup

Tool to perform real-time DNS record resolution for network diagnostics and configuration verification. Use when you need to retrieve current DNS records for a domain or perform reverse DNS lookup for an IP address.

ActionInstant

New Code Scanning Alert Created

Triggers when a new code scanning alert is created in a repository. Fires an event for each newly created code scanning alert detected in the configured repository. Alerts can be filtered by Git reference, scanning tool, state, and severity. The payload includes the alert number, rule details, tool information, state, severity, and the location of the most recent instance.

TriggerPolling

Check Domain Availability

Tool to check if a domain is available for registration with optional suggestions. Use when you need to verify domain availability or get alternative domain suggestions.

ActionInstant

New Repository Collaborator Added

Triggers when a new collaborator is added to a GitHub repository. Monitors the full list of collaborators on a repository and fires an event for each newly added collaborator. The payload includes the collaborator's GitHub username, account ID, profile URL, avatar URL, permission flags (pull, triage, push, maintain, admin), and assigned role name.

TriggerPolling

Get Domain Files Status

Tool to check availability and update status of domain data files including newly registered, expired, and dropped domains. Use when you need to verify that domain data files are prepared and ready for download before accessing file download endpoints.

ActionInstant

Commit Event

Triggered when a new commit is pushed to a repository.

TriggerInstant

IP Geolocation Lookup

Tool to retrieve geographic location information for an IP address including country, city, coordinates, ISP, and security details. Use when you need to identify the physical location of an IP, detect VPN/proxy usage, or gather network intelligence for security or analytics purposes.

ActionInstant

Connect any two apps with Notis in the middle.

Not just GitHub and Whoisfreaks. Any combination from 1,000+ integrations.

When this happens · Trigger

Do this · Action

Save your first hour today.

7 days free trial with 20$ free usage included.
No card. Works with personal or business Whoisfreaks.