Altana — Customer Success Report

_Active = at least one execution in the last 12 months_

1. Employee Onboarding

Description: Automates the complete new hire onboarding journey from offer acceptance to system provisioning. A Greenhouse hire event triggers the full workflow, which uses Claude AI to parse structured address and location data, creates the employee record in BambooHR, sets employment status and job leveling, uploads the offer packet and resume, and creates an IT provisioning ticket.

Business problem: New hire onboarding requires coordinating across recruiting, HRIS, and IT systems — a manual process prone to delays and data entry errors that degrades day-one employee experience.

Integrations: Greenhouse, BambooHR, Anthropic (Claude), HTTP (IT ticketing), Blink Tables

2. IT Endpoint Migration

Description: Automates the Iru endpoint migration process for individual users, coordinating identity verification in Okta, device lookup in Jamf, mobile device enrollment checks, managed Chrome provisioning, and migration enablement across enrolled computers.

Business problem: Endpoint migration projects require multi-system coordination (identity, MDM, access) that is time-consuming to execute manually at scale and prone to missed steps.

Integrations: Okta, Jamf, Entitle (via HTTP)

3. SOC Alert Ingestion & Case Processing

Description: A full SOAR-style alert processing pipeline. Ingestion playbooks pull alerts from six security tools into Blink Case Management; the core Process Alert workflow handles observable extraction, case deduplication, enrichment orchestration, and automated response routing. Simulation playbooks support analyst training and pipeline testing. A live event-driven webhook integration posts AI-generated triage insights from Abstract into the pipeline.

Business problem: Security teams receive high volumes of alerts from disparate tools that must be triaged, correlated, and enriched consistently — a manual process that creates analyst fatigue and slow response times.

Integrations: Wiz, Microsoft Defender for Cloud Apps, CrowdStrike, CrowdStrike Falcon LogScale, Azure Monitor, AWS CloudTrail, Blink Case Management, Abstract (webhook)

4. Alert Enrichment & IOC Lookup

Description: A comprehensive library of enrichment subflows that automatically populate observable context across identities, endpoints, IPs, URLs, and file hashes from multiple threat intelligence and identity sources. A central router dispatches observables to the appropriate enrichment subflow based on type.

Business problem: Analysts manually looking up IOC context across CrowdStrike, Okta, VirusTotal, and other tools during triage accounts for a large share of alert handling time; automated enrichment reduces time-to-context significantly.

Integrations: CrowdStrike, Okta, Google Workspace, Microsoft Entra ID, AbuseIPDB, VirusTotal, URLScan, Slack, GitHub, Bash (whois, dig)

5. Incident Response & EDR

Description: Automated response playbooks for the two primary incident types — phishing and malware — plus a main response router that dispatches based on case type. CrowdStrike RTR playbooks enable analysts to execute remote commands or quarantine/un-quarantine endpoints directly from cases.

Business problem: Manual incident response workflows are slow and inconsistent; automated triage and containment reduce dwell time and free analysts for higher-value investigation.

Integrations: Microsoft Outlook, CrowdStrike (RTR), Blink Case Management

6. Case Management Utilities

Description: A set of utility and maintenance playbooks that keep the case management environment healthy — closing stale cases, managing observable-to-alert relationships, finding similar cases based on shared observables, and providing error notification infrastructure for the broader SOC pipeline.

Business problem: Case management systems accumulate stale and orphaned data over time; automated hygiene workflows keep the environment accurate and actionable without manual curation.

Integrations: Blink Case Management, Email

7. Development / Test

Description: Empty or test workflows with no production logic. Includes stub workflows and a working directory test automation.

8. Credential & Vault Management

Description: Automates 1Password vault and group lifecycle management for IT operations. On-demand playbooks allow IT administrators to add or remove users from 1Password groups and manage vault access permissions, while utility workflows enumerate existing vaults and their assigned managers for access review.

Business problem: Managing access to shared password vaults and security groups in 1Password manually creates delays and risks out-of-sync permissions as team membership changes; automated workflows ensure consistent provisioning and reduce IT overhead.

Integrations: 1Password

Strengths

Active IAM and endpoint automation: The employee onboarding and endpoint migration workflows are live, integrated across Greenhouse, BambooHR, Okta, and Jamf, and leveraging Claude AI for data extraction — a strong indicator of mature, production-grade automation in the People Ops and IT domains.

Well-structured SOC platform foundation: The security workspace contains a complete, architecturally sound SOAR platform: alert ingestion from six sources, a unified case processing pipeline with observable extraction and deduplication, 30 enrichment subflows covering all major observable types, incident response playbooks for the two highest-volume alert categories, and a full suite of case management utilities. This represents significant build investment.

Broad integration coverage for enrichment: The enrichment library covers identity (Okta, Google Workspace, Entra ID, GitHub, Slack), threat intel (VirusTotal, AbuseIPDB, URLScan), and endpoint (CrowdStrike) — a well-rounded IOC context stack.

AI-augmented onboarding: Use of Anthropic Claude for address component extraction and work location determination in the NHO flow demonstrates early adoption of AI-native automation beyond simple API chaining.

SOC pipeline receiving live events: The AI triage webhook integration (285 executions) shows the SOC pipeline is actively ingesting events, demonstrating that the platform architecture is operational and capable of handling production-scale alert volumes.

Gaps

EXAMPLE ingestion sources not yet connected: The six vendor-specific ingest workflows (Wiz, Defender, CrowdStrike, Falcon LogScale, Azure, CloudTrail) remain named "EXAMPLE" with zero executions. Connecting these to live alert feeds would immediately expand automated coverage across the full security stack and compound value from the existing enrichment and response library.

No cloud security or GRC coverage: The entire Cloud Security, Vulnerability Management, and GRC categories have zero playbooks. These are common expansion areas for security teams that have established a SOC foundation.

Phishing response incomplete: The phishing response subflow checks KnowBe4 campaign headers but does not proceed to remediation steps (e.g., pulling the email from other inboxes, blocking the sender, notifying affected users). The malware response subflow similarly routes on remediation status but has no downstream containment logic beyond CrowdStrike isolation.

Duplicate utility patterns: Several enrichment areas have both a "Get User Information Using X" and an "Enrich - Username - X" variant with overlapping functionality. Consolidating these would reduce maintenance surface.

Integration Ecosystem