Evil Sift Maestro Security Triage

UiPath Maestro BPMN orchestration that turns noisy incident telemetry into validated findings, evidence IDs, and a human-review handoff.

Comment

Inspiration

Security teams need speed, but high-risk security automation needs governance and review. Evil Sift Maestro Security Triage uses UiPath as the orchestration and audit layer so detector output becomes a bounded review packet instead of silent autonomous remediation.

What it does

The main artifact is a UiPath Maestro BPMN process for a security-review handoff:

  1. Incident intake
  2. Run Evil Sift API Workflow
  3. Human review of security findings
  4. Review packet created

The supporting UiPath API Workflow processes a synthetic incident bundle and returns a compact security review packet:

  • 14 security events in
  • 4 validated findings out
  • evidence IDs attached to each finding
  • severity, confidence, tactic, rationale, and score for each finding
  • next UiPath action set to human_review

The detector identifies credential-access, lateral-movement, and command-and-control patterns from the event bundle.

How I built it

I built a UiPath Maestro Agentic Process with a simple BPMN path: incident intake, an Evil Sift workflow task, a human-review user task, and review-packet completion.

I also built a supporting UiPath API Workflow with three steps:

  1. Workflow start
  2. Javascript
  3. Response

The JavaScript step contains deterministic detector logic, and the response step returns a bounded packet suitable for analyst review or downstream UiPath orchestration.

UiPath components used

  • UiPath Automation Cloud
  • UiPath Studio Web
  • UiPath Maestro / Agentic Process BPMN
  • UiPath API Workflow
  • UiPath Orchestrator tenant feed publishing
  • UiPath Studio debug output and execution trail

Verified demo

The Maestro BPMN debug run succeeded. The execution trail completed the start event, the Evil Sift task, the human-review user task, and the end event.

The Maestro package is published as v1.0.1 to Orchestrator Tenant (DefaultTenant).

The supporting API Workflow Studio run succeeded and returned event_count 14, finding_count 4, source mock_incident_sample, and ui_path_next_step human_review.

Challenges

The HTTP Webhook connector was evaluated, but it did not become an active trigger in the hackathon tenant. I kept the submission boundary honest: the demo claim is the Maestro BPMN process, the shared package publish, and the supporting API Workflow output, not a live webhook endpoint.

Test Manager was visible, but project creation was blocked by tenant licensing, so I pivoted from the earlier Test Cloud idea to the stronger no-spend Track 2 Maestro BPMN artifact.

Accomplishments

  • Built and debugged a working UiPath Maestro BPMN process in the hackathon tenant.
  • Published the Maestro package as v1.0.1 to the Orchestrator tenant feed.
  • Built a supporting UiPath API Workflow without paid services or external infrastructure.
  • Kept security automation auditable by attaching evidence IDs and validation notes to every finding.
  • Prepared exported UiPath files, sample data, setup notes, architecture notes, screenshots, and a presentation deck.

What I learned

UiPath is strongest here as the governance and orchestration layer. Maestro provides the BPMN handoff, execution trail, and human task, while the security logic can stay deterministic and reviewable.

What's next

  • Bind the Maestro task to a production-grade API Workflow call.
  • Add an active trigger path once the hackathon tenant supports it reliably.
  • Add regression tests for detector behavior across multiple incident bundles.
  • Route analyst approval decisions back into the workflow for closed-loop security operations.

Built With

  • agentic-process
  • bpmn
  • incident-response
  • javascript
  • python
  • security-automation
  • uipath-api-workflows
  • uipath-automation-cloud
  • uipath-maestro
  • uipath-studio-web
Share this project:

Updates