InTouch Hub › For security teams

For security teams

238 items on the hub serve security teams. Ready-to-run automations first, then the tools they build on.

Ready to run (13)

Install and go. Each one is a complete automation with its own schedule or trigger.

• workflow Backup Verifier — Trigger-file driven. When a new backup file lands, runs a size sanity check, verifies archive integrity (tar/zip/sql), and notifies whether the backup is good.
• workflow Better Than CAPTCHA — Guards a published contact address so you can delete the contact form. Header forensics reject forged mail, first-time senders confirm with one reply, and everything else is routed and digested. No puzzles, no third party, no account.
• workflow Datadog Monitor Digest — Daily digest of Datadog monitors and their current alert states.
• workflow documents-backup-s3 — Auto-upload important documents to S3 when new files appear
• workflow Inbox Phishing Scan — Read new mail from any IMAP inbox (read-only), judge each message deterministically, and alert ONLY when a message is phishing — using real SPF/DKIM/DMARC results, sender/reply-to/DKIM alignment, and link domains. No AI.
• workflow Leaked Password Scan — Check a list of your passwords against the Have I Been Pwned breach corpus (~14B exposed passwords) using privacy-preserving k-anonymity — the full password and full SHA-1 hash never leave the machine. Reports which passwords appear in known breaches, how many times, and masks them in the output so the report is safe to email.
• workflow PagerDuty Incident Digest — Daily digest of PagerDuty incidents.
• workflow Phishing Check — Read one Gmail message via the Google Workspace tool and have AI judge whether it is genuine or phishing — using the real SPF/DKIM/DMARC results, sender/return-path/reply-to mismatches, and link domains in the headers.
• monitor DNS Change Watch — Daily DNS snapshot diff against a stored baseline. Notifies when any watched record changes.
• monitor Email / Domain Breach Monitor — Monitor a list of email accounts and/or a verified domain against the Have I Been Pwned v3 API. Keeps state of already-seen breaches and alerts only when a new breach affecting your people is disclosed. Companion to leaked-password-scan (accounts here, passwords there). Requires a paid HIBP API key.
• monitor SSL Certificate Watch — Daily check of SSL certificate expiration dates for a list of domains. Notifies when any certificate is within the configured renewal window.
• skill API Health Monitor — Cluster failures across multiple HTTP endpoint health checks. AI groups failures by region, service, or status code and identifies likely root causes when failures share a pattern.
• skill Log Error Scanner — Cluster ERROR/FATAL log lines by signature, rank by severity and frequency, and surface the top issues from the last hour. AI groups stack-trace variants of the same root cause.

Hand-built tools (14)

• hand-built Datadog — Query Datadog monitors and timeseries metrics and post events via the Datadog v1 REST API.
• hand-built Email Authenticity Check — Judge whether a Gmail message is genuine or phishing from its SPF/DKIM/DMARC results, From/Return-Path/Reply-To/DKIM alignment, and link domains. Deterministic — no AI.
• hand-built Email Authenticity Scan (Batch) — Scan a batch of email messages and report ONLY the phishing ones, deterministically, from SPF/DKIM/DMARC results, From/Return-Path/Reply-To/DKIM alignment, and link domains. No AI. Batch counterpart of email-authenticity-check.
• hand-built GitHub — Read and create GitHub issues, pull requests, releases and repository metadata via the GitHub REST API. Needs an API Key credential holding a personal access token.
• hand-built Grafana — Manage dashboards, data sources, and alerts on a Grafana instance via the HTTP API.
• hand-built LDAP — Search, read, modify and count entries in LDAP or Active Directory.
• hand-built Microsoft Entra Identity — Read Microsoft Entra (Azure AD) users, groups and group membership through Microsoft Graph.
• hand-built Microsoft Entra Sign-in & Audit Logs — Read Entra sign-in logs, directory audit logs and provisioning events through Microsoft Graph. Sign-in logs require Entra ID P1 or P2.
• hand-built Microsoft Graph — Microsoft Graph tenant check, and the shared credential for every msgraph-* connector. Reports which Entra tenant a credential actually points at.
• hand-built Microsoft Intune Devices — Read Microsoft Intune enrolled devices, compliance state, configuration profiles and detected apps through Microsoft Graph. Requires an Intune licence.
• hand-built Network Ping — Ping a host and report if it is reachable
• hand-built Okta — Read Okta identity data — users, groups and assigned applications — through the Okta Management API.
• hand-built PagerDuty — Query and create PagerDuty incidents and services via the PagerDuty REST API.
• hand-built SSH — Execute commands and multi-line scripts on remote hosts over SSH.

Other tools (211)

Transcribed from each vendor’s published API specification — check the operations before you rely on one.

All categories