SysEngineering

Helpdesk Tasks audit publisher

This integration turns production Helpdesk Tasks results into a durable GCP audit dataset and a human-readable monthly Confluence page.

Architecture

1. The Slack backend emits a fixed structured event for accepted, started, successful, blocked, and failed requests.
2. A Cloud Logging sink routes only slack_helpdesk_audit_v1 events from the production Cloud Run service into a partitioned BigQuery table.
3. Cloud Scheduler invokes this private publisher service every 15 minutes.
4. The publisher queries final task results and creates or replaces the current monthly Confluence child page. On the first two days of a month, it also refreshes the previous month to catch late events.

Confluence is the operational view. BigQuery is the durable source of truth. Confluence failures do not affect Slack requests or Google Workspace actions.

Recorded fields

• Event time and task ID
• Slack requester ID and display name
• Action and single/bulk mode
• Target and related account
• Google Workspace route and label
• Success, partial, pending, blocked, or failed result
• Per-step success/failure counts for bundled actions
• Failure category or guardrail reason

OOO message content, OAuth tokens, service-account keys, Slack secrets, and raw exception bodies are never included in audit events.

One-time setup

1. Create a restricted Confluence parent page named Helpdesk Tasks Audit. Monthly pages will be children of this page.
2. Record the numeric Confluence space ID and parent page ID.
3. Create these Secret Manager secrets in okta-workflows-offboard:
   • slack-helpdesk-confluence-email
   • slack-helpdesk-confluence-api-token
4. Give the Atlassian account behind the token permission to view, create, and edit pages under the chosen parent page.
5. Run the deployment script from PowerShell:

cd integrations/slack_helpdesk_module/audit_publisher
./deploy-audit-publisher.ps1 `
  -ProjectId okta-workflows-offboard `
  -ConfluenceSpaceId "123456789" `
  -ConfluenceParentPageId "987654321"

The script creates or updates:

• BigQuery dataset slack_helpdesk_audit
• Partitioned Cloud Logging sink slack-helpdesk-audit-bigquery
• Private Cloud Run service slack-helpdesk-audit-publisher
• Runtime and scheduler service accounts with scoped access
• Cloud Scheduler job slack-helpdesk-audit-publish

The script intentionally requires the Confluence secrets to exist before it runs so credentials are never passed on a command line or committed to Git.

First publish

Structured events only begin after the updated Slack backend is deployed. Run one safe Helpdesk Tasks read action, wait a few minutes for the logging sink, then force the publisher:

gcloud scheduler jobs run slack-helpdesk-audit-publish `
  --location us-central1 `
  --project okta-workflows-offboard

The child page is titled like 2026-08 Helpdesk Tasks Audit.

Operations

• Schedule: every 15 minutes in America/New_York
• Retention: configure a BigQuery dataset/table expiration to match company policy; the deployment script does not assume a retention period.
• Access: restrict both the Confluence parent page and BigQuery dataset to the IT/helpdesk and audit audiences.
• Recovery: each run rebuilds the page from BigQuery, so retrying is safe and cannot duplicate rows.