Automated Darktrace Weekly Anomaly Scorecard
Every Monday, WebRun opens Darktrace, reviews the past week's AI-flagged network anomalies, logs each finding by severity and affected device to Google Sheets, and emails your security lead a scorecard summarizing the week through Gmail.
How do I track Darktrace's AI-flagged network anomalies week over week?
WebRun reviews Darktrace every Monday for AI-flagged network anomalies from the past week, logs each finding by severity and device to Google Sheets, and emails your security lead a scorecard through Gmail. It never takes containment action itself, only reports what the AI model flagged so your team can decide.
- AI-flagged anomalies are ranked by severity every Monday
- High confidence threats are called out instead of buried in a queue
- One Google Sheets log replaces manual export from the console
Built for security operations teams · network security engineers · IT admins · CISOs
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
www.darktrace.comin a real browser with your saved login - no setup, no API keys. -
1
Darktrace - review flagged anomalies
darktrace.com
WebRun opens Darktrace to review flagged anomalies. - Open Darktrace and review anomalies flagged over the past week
- Rank findings by severity and affected device
- Note anything the AI model scored as a high confidence threat
Done when This week's anomalies are ranked by severity and device.
-
2
Google Sheets - log findings by severity
google.com
WebRun opens Google Sheets to log findings by severity. - Open the anomaly tracker in Google Sheets
- Add a row for each finding with severity, device, and status
- Mark previously listed findings as resolved once cleared
Done when The Google Sheets tracker matches this week's findings.
-
3
Gmail - email the scorecard
gmail.com
WebRun opens Gmail to email the scorecard. - Draft and send an email to the security lead with this week's scorecard
- Include counts by severity and any high confidence threat
- Link to the Google Sheets tracker for full detail
Done when The security lead has this week's scorecard by email.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Does WebRun take any containment action itself?
No. WebRun only reads flagged anomalies and reports them. Any containment or response action is a manual step your security team takes in Darktrace.
Does the scorecard include raw network traffic data?
No. It only shares severity, device, and status counts, never raw packet or traffic content.
Who receives the Gmail scorecard?
Only your configured internal security lead address. WebRun never sends the scorecard outside your organization.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.