The problem
When an IT or security admin spots suspicious activity on a user account — a strange login location in their SIEM, an alert in their Datadog dashboard, a tip from a manager — the first 15 minutes are the most expensive. The admin needs to suspend the account quickly, but the suspension itself needs an audit trail that distinguishes "investigation in progress" from "this person was offboarded" so downstream evidence reports stay clean.
What AscendCore does
An IT or security admin invokes /alert-triage <user-email> [reason] from Slack (or types the equivalent message in Microsoft Teams). AscendCore resolves the user in Okta, posts a propose-confirm card to the admin channel showing the user, current Okta status, and the admin's free-form reason, with two buttons: Suspend Pending Investigation (destructive) or Clear — No Action. On approval, the Okta account is suspended. On clear, no action is taken. Either outcome is recorded on the tamper-evident audit chain as a security-investigation event, kept separate from offboarding so SOC 2 evidence reports separate investigations from lifecycle events.
Commands
# Slack
/alert-triage <user-email> [optional reason text]
# Teams (DM the bot or @mention)
alert-triage <user-email> [optional reason text]
Examples:
/alert-triage sarah@acme.com suspicious login from new IP at 03:14/alert-triage marcus@acme.com session from foreign country, manager flagged/alert-triage ben@acme.com— reason omitted; admin will add context in audit notes
Workflow
- Invoke — IT/security admin types the slash command (Slack) or message (Teams) with the user email and optional reason
- Resolve — Okta lookup; surfaces disambiguation if multiple matches
- Propose — admin channel card with user identity, current Okta status, and the admin's reason; two buttons (Suspend / Clear)
- Approve — admin clicks Suspend (destructive) or Clear (no action)
- Execute: on Suspend, the Okta account is suspended; on Clear, nothing changes in Okta
- Notify — requester DM'd by the bot with the outcome
- Audit: the decision is recorded on the tamper-evident audit chain as a security-investigation event, separate from offboarding
Integrations
- Okta: account suspension
- Slack + Microsoft Teams — Admin-invoked entry point and approval surface, with full Block Kit and Adaptive Card parity
Roadmap: alert correlation
Starting a triage automatically from a Datadog or PagerDuty alert that names a user is on the roadmap. Today, admins invoke /alert-triage after seeing the alert.
Status
Live in production — admin-invoked flow shipped May 2026 with Slack + Teams parity, Okta suspension execution, and tamper-evident audit chain integration. Alert auto-correlation is on the roadmap as a separate enhancement.
