OpenText Webroot Unity - OpenText Workflow Service Integration and Automation

Common Integration Use Cases Between OpenText Webroot Unity and OpenText Workflow Service

OpenText Webroot Unity and OpenText Workflow Service complement each other well in enterprise environments where security events must trigger structured business action. Webroot Unity detects and manages endpoint threats, while Workflow Service routes incidents, approvals, escalations, and remediation tasks across security, IT, compliance, and business teams.

• Automated malware incident response

  Data flow: OpenText Webroot Unity to OpenText Workflow Service

  When Webroot Unity detects malware on an endpoint, it can automatically create a workflow case in OpenText Workflow Service. The case can assign tasks to IT operations for device isolation, to security analysts for investigation, and to service desk teams for user communication. This reduces response time and ensures every incident follows a documented remediation process.

• Phishing alert triage and investigation

  Data flow: OpenText Webroot Unity to OpenText Workflow Service

  Phishing detections from Webroot Unity can be routed into a workflow that classifies the alert by severity, affected user, and business unit. The workflow can notify security teams, open a ticket for email security review, and request confirmation from the user or manager if credentials may have been exposed. This improves consistency in phishing response and helps reduce repeat incidents.

• Ransomware containment and business continuity coordination

  Data flow: OpenText Webroot Unity to OpenText Workflow Service

  If Webroot Unity identifies ransomware behavior, Workflow Service can launch a high-priority containment process that coordinates endpoint isolation, executive notification, backup validation, and recovery steps. The workflow can also track approvals for restoring systems and document actions for audit and post-incident review. This supports faster recovery and stronger governance during critical security events.

• Security exception approval workflow

  Data flow: OpenText Workflow Service to OpenText Webroot Unity

  When a business user or application owner requests an exception for a blocked file, website, or endpoint control, Workflow Service can manage the approval process across security, compliance, and IT stakeholders. Once approved, the workflow can update Webroot Unity with the exception details or request a policy change. This creates controlled flexibility without bypassing security oversight.

• Endpoint remediation task management

  Data flow: Bi-directional

  Webroot Unity can detect a compromised or noncompliant device and send the event to Workflow Service, which then creates remediation tasks such as patching, reimaging, password reset, or user retraining. As teams complete actions, status updates can flow back into the workflow and be reflected in the security case. This gives security and IT a shared view of progress and accountability.

• Compliance evidence collection for security incidents

  Data flow: OpenText Workflow Service to OpenText Webroot Unity

  Workflow Service can orchestrate the collection of incident evidence, including analyst notes, remediation approvals, and closure confirmations, after a Webroot Unity alert. The workflow can ensure required documentation is completed before a case is closed and retained for audit purposes. This is especially useful for regulated industries that need proof of incident handling and control execution.

• Recurring threat pattern review and policy update process

  Data flow: OpenText Webroot Unity to OpenText Workflow Service

  When Webroot Unity identifies repeated threats affecting the same department, device group, or geography, Workflow Service can open a review workflow for security operations and policy owners. The process can gather incident history, request root cause analysis, and route policy updates for approval and implementation. This helps organizations move from reactive response to preventive control improvement.

These integrations help organizations turn endpoint security alerts into structured, auditable business processes, improving response speed, coordination, and compliance across security and IT teams.