Defense & national security use case · Amazon Web Services + ServiceNow + Jira
Cloud incident to controlled remediation
Cloud alerts are handled ad hoc, remediation happens without change records and post-incident review lacks evidence. Cloud events become incidents and engineering tasks, and remediation runs only when approved.
Systems involved
What each system contributes
61 actions
- EC215
- IAM21
- Lambda10
Trigger source: AWS S3, AWS SNS, AWS SQS, AWS CloudWatch, AWS CloudWatch Events
Architecture
One governed run
How it starts: AWS CloudWatch, CloudWatch Events, SNS, SQS or S3 events start the run.
Step by step
How the process runs
- 01
Event
A CloudWatch, SNS, SQS or S3 event starts the run.
- 02
Enrich
Resource context is read from AWS and matched by Rules + Code.
- 03
Incident
A ServiceNow incident is opened with the evidence.
- 04
Engineering task
A Jira issue is created for the owning team.
- 05
Remediate
An approved EC2, IAM or Lambda action runs.
Control
Human decision and exception path
Human decision
An operator approves any production-affecting AWS action through the change.
Exception path
- Unmatched resources go to triage.
- Failed actions keep the incident open.
- Duplicate events update the existing incident.
Evidence
What gets audited
- The source event.
- Enrichment results.
- Incident, issue and change references.
- AWS requests and responses.
Nexus runs on premises, in private or sovereign cloud, or air-gapped. Credentials stay in the vault, roles decide who can approve, and the execution record stays inside your deployment boundary.
Sovereignty and deploymentRelated
Patterns, connectors and next steps
- ServiceNow-Jira integration
Integration pattern · Incidents and changes reach engineering with context, and status returns to service.
- AWS-ServiceNow integration
Integration pattern · Cloud events become enriched incidents and approved changes.
- Amazon Web Services connector
61 pre-built actions
- ServiceNow connector
55 pre-built actions
- Jira connector
36 pre-built actions
- Infrastructure orchestration
Operations runbooks with approval and evidence.
- Privileged access change with approval
Another defense & national security use case.
FAQ
Questions about this use case
- Does Nexus replace any of these systems?
- No. Each system keeps its own records. Nexus runs the process between them and records each decision.
- How does the run start?
- AWS CloudWatch, CloudWatch Events, SNS, SQS or S3 events start the run.
- What if a step is not covered by a pre-built action?
- It runs through an API, protocol or database call, or as Rules + Code in Python, Bash, Go, Java, .NET, PHP, PowerShell or JavaScript/TypeScript, with the same approvals and audit.
Use case review
Discuss this use case
Bring your version of the process. We will map the systems, approvals and evidence it needs.