Use Case: SOC Operations
Automated user verification
A suspicious login was detected. ManySignal sent a Slack message to the user: 'Did you just log in from London?' The user replied 'No.' Account suspended. Analyst paged. Total elapsed time: 4 minutes.
The fastest resolution is asking the user
For many alert categories — suspicious login location, unusual data access, unexpected device — the fastest path to resolution is simply asking the user whether the activity was theirs. This is something banks have done via SMS for decades. Security operations teams rarely do it automatically because it requires integration between the alert system and a messaging channel, a well-designed message that doesn't alarm the user unnecessarily, and logic to act on the response autonomously.
ManySignal builds the verification workflow into the triage playbook as a standard step, using Slack or Teams as the primary channel. For many alert types, a user confirmation is sufficient to close the case autonomously; a denial triggers immediate escalation with the denial as evidence.
workflow: automated_user_verification
trigger: alert requiring_user_context
steps:
1. format_message:
- include: specific_activity, time, location
- ask: "Was this you? [Confirm / Not me]"
- channel: slack_dm (primary), sms (fallback at 5m)
- timeout: 10 minutes
2. on_confirm:
- action: close_alert with "user_confirmed" rationale
- log: verification_response to case audit trail
- optional: update_trusted_location
3. on_deny:
- action: suspend_account (if configured autonomous)
- page: on_call_analyst with full evidence
- priority: P1, bypass queue
4. on_timeout:
- escalate: to analyst with context "user_unreachable"
- action: treat as unresolved, maintain alert openUser verification FAQ
How does ManySignal contact a user for verification without exposing that they're under investigation?
ManySignal sends verification requests that look like standard security notifications — the same channel and format as legitimate MFA challenges or security check-ins. The message asks the user to confirm or deny an action without revealing that it's part of a security investigation. If the user confirms, the alert is closed. If they deny, the full investigation escalates immediately.
What verification channels does ManySignal support?
Slack DM, Microsoft Teams message, SMS (via Twilio or AWS SNS), email, and push notification via a mobile app. The verification method is configured per organization and can be set per user type (executives may have different preferences than standard employees). Fallback channels activate if the primary isn't acknowledged within a configured timeout.
Does user verification create a social engineering risk?
There is a risk that a sophisticated attacker in control of the user's account could intercept and respond to the verification request. ManySignal mitigates this by: using out-of-band channels (SMS to a registered phone, not email to the potentially compromised account), including a session identifier that the user must confirm matches their activity, and treating non-response within 5 minutes as a denial rather than confirmation.
Can user verification be automated end-to-end without analyst involvement?
Yes. For configured alert types, ManySignal can send a verification request, receive the user's response, and take action autonomously — closing the case if confirmed, escalating to account suspension if denied. This is the most fully automated use case in ManySignal's playbook library.
Resolve suspicious activity in 4 minutes by asking the user
Automated verification via Slack and SMS — confirmation closes the case, denial escalates instantly.