accretive — Customer Success Report

1. Palo Alto CVE & Security Advisory Tracking

Category: Vulnerability Mgmt | Subcategory: CVE lookup & remediation

Description: Automatically ingests the Palo Alto Networks security RSS feed on an hourly schedule, parses each new CVE and advisory, and creates a corresponding Jira ticket. This eliminates the manual work of monitoring vendor advisories and ensures every published vulnerability is immediately tracked in the organization's ticketing system.

Business problem solved: Security teams routinely miss or delay acting on vendor CVE feeds because manual monitoring is error-prone and slow. This playbook guarantees every Palo Alto advisory is captured, catalogued, and assigned — at the moment it is published.

Integrations: HTTP (RSS/XML fetch), Jira Data Center

2. Employee Onboarding — AD Account Activation

Category: IAM | Subcategory: Employee onboarding, Identity sync & directory mgmt

Description: Enables new hire Active Directory accounts on their start date for both U.S. and European (Hungary/Romania) timezones. A scheduled daily job checks Jira for new hire tickets and activates the corresponding AD account at the appropriate local business time. A companion workflow handles VPN IP assignment and Netbox registration during onboarding.

Business problem solved: Delayed account activation on a new hire's first day creates a poor employee experience and productivity loss. These playbooks ensure accounts go live exactly when needed — in the correct timezone — without requiring an IT admin to manually action each ticket.

Integrations: Jira Data Center, Active Directory (on-prem / WinRM), Microsoft Graph, NetBox

3. Firewall Policy Compliance Monitoring

Category: GRC | Subcategory: Security metrics & reporting, PCI & regulatory monitoring

Description: Runs a daily Splunk query against Palo Alto Panorama configuration logs to identify firewall rules with local policy overrides — rules that deviate from the centrally managed Panorama templates. When overrides are detected, a formatted report is delivered to the security team for review.

Business problem solved: Local firewall rule overrides are a common audit finding and a sign that policy governance is breaking down. This playbook provides daily visibility into policy drift so the network security team can remediate deviations before they become compliance gaps.

Integrations: Splunk (HTTP/Ad Hoc query), Jira Data Center

4. Backup Failure Monitoring & Alerting

Category: Other | Subcategory: IT/OT & network infra monitoring

Description: Listens for inbound webhook events from the backup platform. When an event containing a backup failure keyword is received, the playbook classifies and routes the alert for IT operations response.

Business problem solved: Undetected backup failures are a silent disaster risk — they often go unnoticed until a restore attempt fails. This event-driven playbook ensures every backup failure generates an immediate, actionable alert rather than disappearing into a log.

Integrations: Custom Webhook (backup platform)

5. SentinelOne Threat Detection & Case Management

Category: SOC | Subcategory: EDR containment & response, Case mgmt & SOAR

Description: End-to-end automated response pipeline for SentinelOne endpoint threats. When S1 detects a threat (via webhook), the playbook deduplicates against existing Jira tickets, creates a new case if needed, and optionally escalates for analyst review via Teams interactivity. Separate variants cover U.S. and Hungary S1 environments. Additional playbooks support analyst-initiated triage review and host isolation lift.

Business problem solved: Manual threat triage creates alert fatigue and delays response. These playbooks ensure every S1 threat is immediately logged as a Jira ticket, duplicate alerts are suppressed, and analysts are only interrupted when genuine escalation is warranted.

Integrations: SentinelOne, Jira Data Center, Microsoft Teams, Microsoft Outlook (email webhook), VirusTotal (IOC enrichment implied)

6. VPN Session Enforcement & Self-Service

Category: IAM | Subcategory: JIT & temporary access, Identity lifecycle automation

Description: A multi-component system for enforcing VPN session termination across both Palo Alto and Cisco FTD firewall platforms. The primary orchestrator queries NetBox for all active VPN firewall devices, spawns parallel helper subflows per device, and collects results. A self-service variant allows employees to disconnect themselves from VPN (e.g., before an IT action). An additional analytical workflow cross-references Splunk VPN login data against the SentinelOne agent inventory to surface devices on VPN without EDR coverage.

Business problem solved: Terminating a user's VPN session during an incident, offboarding, or policy violation requires coordinating across multiple heterogeneous firewall platforms. Manual execution is slow and error-prone. These playbooks reduce a multi-step, multi-device operation to a single automated action.

Integrations: NetBox, Palo Alto Networks (SSH/Paramiko), Cisco FTD (SSH/Paramiko), Blink (cross-automation call), SentinelOne, Splunk, Microsoft Teams

7. MFA & Password Lifecycle Management

Category: IAM | Subcategory: Password & credential lifecycle, Identity lifecycle automation

Description: A set of Teams-driven self-service workflows enabling IT administrators or security staff to re-enforce MFA requirements and reset passwords for users in Hungary and global scopes. Each workflow validates the runner's identity, prompts for the target user via Teams, performs verification steps, then executes the credential action in Active Directory. A re-require MFA variant additionally lists and revokes existing MFA methods before forcing re-registration.

Business problem solved: MFA bypass, credential compromise, and account lockout resolution are high-frequency IT operations that consume significant analyst time when handled manually. These playbooks give authorized staff a guided, audited self-service path via Microsoft Teams.

Integrations: Microsoft Entra ID (Graph API), Active Directory on-prem (WinRM), Microsoft Teams, Jira Data Center

8. IT Self-Service & Helpdesk

Category: Other | Subcategory: IT helpdesk & ticket routing

Description: A collection of employee-facing self-service automations. Account unlock allows a user to unlock their own AD account without opening a ticket. A Confluence search assistant enables analysts to search the knowledge base via a Teams conversation and receive article links. An ADManager Plus notification relay sends real-time user provisioning events from ADManager Plus into Teams.

Business problem solved: Low-complexity, high-frequency IT requests (account unlocks, knowledge-base lookups) consume helpdesk capacity disproportionate to their value. These playbooks route self-resolvable requests directly to the user, reducing ticket volume and wait times.

Integrations: Active Directory (Microsoft Graph), WinRM, Jira Data Center, Confluence Data Center, Microsoft Teams, Custom Webhook (ADManager Plus)

*Note: VPN kicker is also counted in Use Case 6 (VPN Session Enforcement). It appears here because its primary invocation path is a Teams-initiated helpdesk action.*

9. Identity & HR Attribute Management

Category: IAM | Subcategory: Identity lifecycle automation

Description: Automates job title changes in Active Directory via Teams interactivity. The workflow validates that the requester is an authorized manager, retrieves the target user's AD record, applies the new title via WinRM, and opens a Jira ticket as an audit record. A Hungary-scoped and an all-users variant exist.

Business problem solved: Title changes are a frequent HR event that require an IT admin touchpoint to update Active Directory — introducing delays and manual error risk. These playbooks let authorized managers self-serve the change with a full audit trail.

Integrations: Microsoft Entra ID (Graph API), Active Directory on-prem (WinRM), Microsoft Teams, Jira Data Center

10. Employee Offboarding & Termination

Category: IAM | Subcategory: Employee offboarding, Full employee lifecycle

Description: A comprehensive employee termination workflow that disables the AD account on-prem, resets the password in both on-prem AD and Entra ID, revokes active Entra sessions, kicks the user from VPN (calling the VPN enforcement use case), modifies the AD description field to record the termination, and creates a Jira audit ticket — all within a single Teams-guided interaction. A NetBox cleanup companion workflow releases the user's assigned VPN IP from the address range.

Business problem solved: Employee termination requires coordinated action across identity systems, VPN, and ITSM. Gaps in any step create security risk (live credentials, active VPN sessions). This playbook enforces a repeatable, complete offboarding checklist with an audit trail.

Integrations: Microsoft Entra ID (Graph API), Active Directory on-prem (WinRM), Microsoft Teams, Jira Data Center, NetBox, Blink (cross-automation for VPN kick)

11. Teams Guest Access Review

Category: IAM | Subcategory: Access review & group mgmt, RBAC review & access mgmt

Description: Audits all guest accounts in Microsoft Entra ID, maps each guest to the Teams channels they have access to, identifies the owners of those channels, and sends access review emails to each owner with an attached CSV report. A Jira ticket is created per review cycle. The workflow uses Microsoft Graph API and MSAL for token acquisition to enumerate Teams membership at scale.

Business problem solved: External guest accounts accumulate in Microsoft Teams over time, often outliving the business relationship. Without periodic review, this creates a data exposure risk and a compliance gap. This playbook automates the access review cycle that would otherwise require manual admin effort.

Integrations: Microsoft Entra ID (Graph API), Microsoft Teams (Graph API), Jira Data Center, Email (Python SMTP)

12. Risky User Monitoring

Category: SOC | Subcategory: Identity threat response

Description: Queries Microsoft Entra ID for users flagged as "risky" (elevated sign-in risk score), stores results in a Blink table for tracking, and surfaces the data via Teams message. A Jira webhook can also trigger the query on-demand.

Business problem solved: Entra ID identity risk signals (impossible travel, leaked credentials, unfamiliar sign-ins) are often unactioned because they require proactive log review. This playbook surfaces risky users in the analyst's primary communication channel and persists the data for trend analysis.

Integrations: Microsoft Entra ID (Active Directory), Microsoft Teams, Blink Tables, Jira (webhook trigger)

13. Wazuh SIEM Detection Engineering

Category: SOC | Subcategory: SIEM & log pipeline monitoring, Threat hunting & detection

Description: A detection engineering playbook that queries the Wazuh SIEM and Wazuh Indexer across 10+ detection categories: disconnected agents, critical alerts (levels 12–15), SSH logins, new user creation, sensitive group additions, scheduled task modifications, LSASS dump attempts, and suspicious parent process creation. Results are formatted for analyst review.

Business problem solved: Building and validating detection coverage across a Wazuh deployment requires repeated manual queries across multiple log indices. This playbook codifies the detection engineering workflow, enabling systematic coverage checks and tuning.

Integrations: Wazuh (REST API, Indexer/OpenSearch API)

14. IT Asset & Network Inventory

Category: Other | Subcategory: IT/OT & network infra monitoring

Description: A two-part asset lifecycle system. The SN Intake Form presents a web form for staff to record serial numbers against purchase orders as hardware arrives; each submission is processed into NetBox. A companion daily scheduled job performs a NetBox true-up, synchronizing the serial number table with current NetBox records to capture device changes.

Business problem solved: Accurate hardware asset tracking requires real-time data entry at receipt and ongoing reconciliation against the authoritative IPAM/DCIM system. Manual processes create stale records and audit risk. These playbooks automate both data capture and daily reconciliation.

Integrations: Blink Web Forms, NetBox

15. Development / Sandbox

The following workflows are test, prototype, or infrastructure-level automations with no production executions in the last 12 months.

Strengths

Vulnerability tracking at scale. The Palo Alto RSS ingestion playbook is the highest-volume automation at 964 executions — running every hour to capture CVEs and security advisories. This represents a meaningful reduction in analyst overhead for vendor advisory monitoring and ensures zero advisories are missed.

Multi-region, timezone-aware IAM. The organization operates across U.S., Hungary, and Romania and has built corresponding IAM automation for each region. New hire AD activation, MFA enforcement, title changes, and offboarding all have separate Hungary-scoped variants, showing mature operational segmentation.

Layered VPN enforcement. The VPN disconnection system is well-architected: a NetBox-driven device inventory feeds a parallel orchestrator that fans out to both Cisco FTD and Palo Alto platforms simultaneously. The addition of a self-service path reduces IT intervention for routine disconnection requests.

Comprehensive offboarding blueprint. The SelfService Termination playbook covers the full offboarding checklist in a single workflow: on-prem AD disable, Entra disable + session revoke, VPN kick, IP cleanup (NetBox), and Jira audit ticket. This is a strong foundation even though it has not yet run in production.

Dual EDR environments. Separate SentinelOne playbooks for U.S. and Hungary environments (18 total executions) show that the threat detection pipeline is active across both geographic footprints.

Gaps & Opportunities

Offboarding not yet in production. The SelfService Termination workflow has 0 executions despite being fully built. Activating it would bring the full IAM lifecycle under automation and reduce the risk of incomplete offboarding steps.

MFA and password reset workflows underutilized. Reset Password and Re-Require MFA (All Users) have 0 executions; the Hungary-scoped MFA variant has only 8. These workflows appear ready — driving adoption through IT team enablement could increase usage significantly.

Guest access review not yet run. Teams Guest Accounting is built and complete but shows 0 executions. Running this quarterly would generate an audit-ready access review report and address a common compliance gap.

Risky User Monitoring not operationalized. The Gather Risky Users playbook exists but has not run. Scheduling it daily or connecting it to an Entra risk event would turn a dormant capability into an active identity threat detection signal.

Wazuh SIEM coverage not yet scheduled. The detection engineering playbook covers 10+ Wazuh alert categories but has not been scheduled. Converting it to a scheduled daily or weekly run would provide continuous SIEM health and coverage reporting.

SentinelOne triage on-demand not wired to the event pipeline. The On-Demand triage variant (SentinelOne Alert Triage Final On-Demand) has 0 executions. Connecting it to the event-driven S1 webhook pipeline as an escalation handler would complete the automated triage → analyst review → containment loop.

Integration Ecosystem