Accendra — Customer Success Report

1. Core SOC Platform & Case Management

Description: The central orchestration layer for Accendra's security operations. Blink powers the full alert-to-case lifecycle — ingesting observables, executing response playbooks, managing case state, notifying analysts, and closing cases — replacing a manual SOAR workflow with fully automated orchestration.

Business problem solved: Manual triage and case management across multiple security tools creates analyst fatigue, inconsistent documentation, and slow response times. This use case eliminates repetitive mechanical work so analysts focus on investigation and decision-making.

Integrations: Blink Case Management, Rapid7 InsightIDR, CrowdStrike, Outlook/Email

2. SIEM & EDR Alert Ingestion

Description: Automated connectors that pull and normalize security alerts from Rapid7 InsightIDR (SIEM) and CrowdStrike Endpoint Protection/Identity Detection (EDR/IDP) into the Blink case management platform, ensuring every alert is captured, deduplicated, and queued for processing.

Business problem solved: Without automated ingestion, analysts must manually poll SIEM and EDR consoles for new alerts — a slow, error-prone process that introduces coverage gaps. Blink's connectors provide continuous, zero-touch alert capture across all integrated platforms.

Integrations: Rapid7 InsightIDR, CrowdStrike EPP, CrowdStrike IDP, IBM Resilient (legacy migration)

3. Identity Threat Response — Azure AD Risky Users

Description: Continuous 5-minute polling of Azure Active Directory for risky user events, with automated case creation and structured analyst resolution workflows. When a risky user is flagged, Blink creates a case, notifies the analyst, and surfaces three response actions: dismiss (false positive), confirm compromise, or confirm safe — each syncing the outcome back to Azure AD.

Business problem solved: Identity-based attacks are among the most common initial access vectors in healthcare environments. Automating Azure AD risky user triage ensures near-real-time detection coverage and consistent response, even across off-hours, without requiring analysts to monitor the Azure portal continuously.

Integrations: Microsoft Azure Active Directory (Entra ID), Blink Case Management

*\* Polling infrastructure — each execution is a 5-minute schedule tick, not an individual alert event.*

4. Alert Enrichment & IOC Investigation

Description: A comprehensive library of on-demand and subflow enrichment playbooks that automatically gather threat context on observables — IP addresses, file hashes, URLs, domains, email addresses, and user identities — across threat intelligence platforms and identity directories. Enrichments are triggered automatically as part of the main alert processing pipeline.

Business problem solved: Investigating a security alert manually requires an analyst to run lookups across 8+ tools for every observable. Blink's enrichment library automates this context-gathering in seconds, ensuring analysts arrive at each case with full context already populated.

Integrations: VirusTotal, AbuseIPDB, URLScan, ANY.RUN, WHOIS, CrowdStrike, Okta, Microsoft Entra ID / Azure AD, Google Workspace, Slack, GitHub

5. DLP Incident Triage

Description: A dedicated workspace for automated ingestion and initial processing of data loss prevention incidents. Incoming DLP events are automatically structured into cases, observables are extracted, and the full enrichment + response subflow library is available for analyst-driven investigation.

Business problem solved: DLP platforms generate high volumes of incidents that vary widely in severity. Blink automates the ingestion and first-pass triage so analysts work from a normalized, enriched case view rather than raw DLP console events.

Integrations: DLP platform (via webhook), Microsoft Entra ID, Okta, Google Workspace, CrowdStrike, VirusTotal, AbuseIPDB, URLScan, WHOIS, Outlook

6. Threat Intelligence Curation — H-ISAC

Description: Automated monitoring of the Health Information Sharing and Analysis Center (H-ISAC) threat intelligence email feed. Blink parses incoming bulletins from Outlook, extracts relevant threat data, and creates structured case attachments so intelligence is immediately available to analysts — without manual email review.

Business problem solved: Healthcare sector threat intelligence (ransomware campaigns, nation-state TTPs targeting medical orgs) arrives via email feeds that are easy to miss or process inconsistently. Blink ensures every H-ISAC bulletin is captured, timestamped, and linked to cases for analyst consumption.

Integrations: Outlook, H-ISAC TLP feed, Blink Case Management

7. EDR Containment & Response

Description: A library of pre-built containment and remediation playbooks for use during active incidents. Covers CrowdStrike endpoint isolation (quarantine/lift), remote response command execution against single or batches of hosts, Palo Alto IOC blocking, and response subflows for phishing and malware alert types.

Business problem solved: During a live incident, every minute without containment increases blast radius. Blink delivers one-click endpoint isolation and network-level IOC blocking, removing the need for analysts to navigate separate consoles under pressure.

Integrations: CrowdStrike (RTR, host isolation), Palo Alto Networks

Training / Development Workspace

The following playbooks reside in a dedicated training workspace (ca4b0c4a). They are development and analyst training copies of production playbooks and are excluded from production KPI counts. "New Workflow 2" (11,521 executions) appears to be a scheduled polling workflow running in parallel to production identity polling.

Strengths

Deep SOC automation at scale. The platform is running at production volume — 25,633 cases closed, 9,322 alerts processed end-to-end, and 6,395 IRP playbooks auto-triggered over 12 months. This represents a fully operational Agentic SOC, not a pilot.

Dual-source alert coverage. Both Rapid7 InsightIDR (SIEM) and CrowdStrike (EPP + IDP) are fully integrated and ingesting in real time. The split between OMI and ACC variants suggests the environment supports a multi-tenant or segmented network model, each with its own alert pipeline.

Identity threat response at continuous coverage. Two parallel polling workflows (OMI and ACC) check Azure AD for risky users every 5 minutes around the clock. With 395 identity events actioned over 12 months, this is one of the highest-value response loops in the environment — particularly critical given the prevalence of identity-based attacks in healthcare.

Dedicated DLP workspace. The DLP incident pipeline is fully operational (2,755 incidents ingested across two intake paths — the original webhook feed plus a newer Outlook-based ACH intake at 474 executions — with 2,231 processed). The DLP workspace carries a complete mirror of the enrichment and response subflow library, providing the same depth of investigation capability as the main SOC workspace.

Healthcare-specific threat intelligence automation. H-ISAC bulletin processing is live and tracked. Processing sector-specific threat intel automatically — without analyst mailbox monitoring — is a differentiator for healthcare security programs operating under regulatory scrutiny.

Sandbox analysis capability is now active. ANY.RUN integration has moved beyond configuration into live use: Run New Analysis - URL-Domains auto-triggers on new URL/Domain observables (19 detonations in the last 12 months) and Get Analysis Report-Auto retrieves and attaches results to cases automatically, enabling detonation-based analysis without analyst intervention.

Gaps & Opportunities

Enrichment library has low utilization. The full enrichment library (VirusTotal, AbuseIPDB, URLScan, hash lookups, user lookups across 5+ directories) shows near-zero direct executions, despite high alert volume. This likely indicates enrichment subflows are triggered correctly as part of the main pipeline (via the router) but may not be firing consistently — worth validating that the Subflow - Enrich Observables router is being called for all alert types.

EDR containment playbooks are deployed but unused. CrowdStrike endpoint quarantine, batch RTR, and Palo Alto IOC blocking have 0–2 executions. These are high-value containment actions. If they haven't been tested in a live scenario, a tabletop exercise or controlled red team drill would validate readiness before a real incident requires them.

Identity response resolution rate. Of risky user events detected, 337 were dismissed (false positives) and 57 resolved via case closure — but zero were confirmed as actual compromises via the Confirm Risky User Compromise playbook. This is either a sign of a clean environment or that compromise confirmations are being handled outside Blink (e.g., direct console actions). Closing this loop through Blink would improve audit traceability.

Phishing detection & response not yet active. Response Subflow - Phishing is deployed (in both SOC and DLP workspaces) but has 0 executions. Given that phishing remains a top initial access vector in healthcare, activating automated KnowBe4 simulation filtering and analyst-initiated phishing response workflows would close a visible gap.

Stale case management utility unused. Utility - Close Stale Cases (auto-closes cases inactive for a month) has 0 executions. With 25,633 cases processed, enabling scheduled stale-case cleanup would reduce backlog noise and keep the case queue meaningful.

Integration Ecosystem