CorpSec Helpdesk Slack Issue Automation

Overview

When you ask for help in the #it_help channel, this automation will automatically create a new GitLab issue that creates a long term record of your support request, while providing the ease-of-use of a Slack thread.

Each comment in the Slack thread is added to the GitLab issue.

This allows us to dogfood GitLab, and also link to related GitLab issues if additional triage is needed or we are cross-linking the audit trail of change management activity, laptop requests, etc.

Google Workspace Deprovisioning

Google Workspace deprovisioning is composed of 2 parts that are outlined below. The first part happens as part of the initial offboarding. The second part occurs after 90 days from the offboarding. This workflow will send out notifications throughout this 90 day period to let the Former Team member’s manager know that the final deadline is approaching.

These are the steps that follow immediately upon termination of a team-member

  • Signs a user out of all web and device sessions and reset their sign-in cookies.
  • Update user profile
    • reset password
    • remove from Global Address list
    • remove recovery email
    • remove recovery phone
    • move to /Former Team Members organizational unit
    • unsuspend user if suspended
  • Remotely wipe coprorate Google Workspace data from mobile devices
  • Delete access tokens (OAuth tokens)
  • Delete application specific passwords (ASPs)
  • Delete verification tokens
  • Remove user membership from Google groups.
  • Create and set a vacation auto-reply in the user’s Gmail
  • Make manager a Gmail delegate
  • Create a transfer request and transfer the following data to the user’s manager
    • Google Drive
    • Google Calendar

These are the steps that follow after the Former Team Member has been gone for 90 days

  • Update user profile
    • move to /NoGSuiteLicense organizationl unit
  • Delete all aliases
  • Suspend the user

The following notifications will be sent out to the fortmer team member’s manager via Slack

Immediate Slack notification: