ASSUTA — Customer Success Report

*No execution-based metrics are available for this period.*

Total: 20 playbooks across 6 use cases (includes duplicates across staging and production workspaces)

1. Network Threat Containment via Palo Alto FW EDL

Description: Automates the blocking of malicious IP addresses at the Palo Alto firewall by maintaining an External Dynamic List (EDL), triggered both manually and through Zendesk incident tickets. Includes whitelist validation and bi-directional Zendesk ticket updates.

Business problem: Security analysts must act quickly when malicious IPs are identified — manual firewall rule edits are slow and error-prone. This pipeline automates containment from the moment an incident is raised in Zendesk, with notification via SMS and a documented audit trail back into the ticket.

Integrations: Palo Alto Firewall (EDL via SMB), Zendesk, Blink Tables, SMS

2. Endpoint Detection & Response

Description: Automates endpoint containment and investigation via Cortex XDR — covering endpoint isolation with email notification, malware scanning, AD endpoint lookup, and enabling/disabling AD user accounts directly from the XDR platform via script execution.

Business problem: When a threat is detected on an endpoint, analysts must contain it before lateral movement occurs. Manual isolation and AD account management introduce critical delay; these playbooks automate the full response chain with approval gates for high-impact actions and status reporting back to the team.

Integrations: Cortex XDR, Active Directory (via XDR Script Library), SMTP

3. Identity & Access Management

Description: Automates user account lifecycle actions in Microsoft Entra ID — enabling and disabling accounts with whitelist-based validation, plus revoking all active sessions for a user — both with approval gates.

Business problem: During incidents or offboarding, time-sensitive identity actions (account disable, session invalidation) must execute immediately and consistently. Manual portal operations introduce lag and skip validation steps; these playbooks enforce input validation, whitelist checks, and structured approval before any account action is taken.

Integrations: Microsoft Entra ID, Blink Tables

4. Notification Infrastructure

Description: Reusable notification subflows providing email delivery (SMTP and table-driven) and bulk SMS, used as building blocks by security response playbooks throughout the library.

Business problem: Security workflows need consistent, multi-channel alerting — email to stakeholders for audit trails, SMS for urgent time-sensitive escalations. These utilities standardize notification delivery and avoid duplicating integration logic across playbooks.

Integrations: SMTP, SMS provider, Blink Tables

5. Data & Table Management

Description: Utility playbooks for managing Blink table content — importing structured data from Google Sheets and inspecting table state — used to keep reference data (IP whitelists, user allow-lists) current for downstream security workflows.

Business problem: Security workflows depend on Blink Tables for dynamic reference data that changes over time (e.g., IP whitelists, approved user lists). These playbooks allow the security team to refresh that data from upstream sources without manual intervention in the Blink UI.

Integrations: Google Sheets, Google Workspace, Blink Tables

6. Development / Uncategorized

Description: Unfinished or test playbooks not yet promoted to a production use case.

Strengths

1. Well-scoped network containment pipeline. The EDL automation is the most complete use case — covering single and bulk IP blocking, whitelist management, and full bi-directional Zendesk integration (event in, ticket comment out, SMS notification). This is a meaningful SOC automation that eliminates manual firewall edits under incident pressure.

1. Zendesk as SOC ticketing hub. The webhook-triggered architecture cleanly routes Zendesk incidents to automated response actions, establishing a solid SOAR pattern that can be extended to additional response types without reworking the entry point.

1. Approval gates on sensitive actions. Endpoint isolation (Cortex XDR - Isolate Endpoint) and user enable/disable (Microsoft Entra ID - Enable or Disable User) both require an approve input, indicating deliberate human-in-the-loop design for high-impact actions — a sign of mature automation governance.

1. Reusable notification layer. SMS and email flows are built as independent, callable utilities rather than embedded per-playbook. This keeps notification logic DRY and makes future changes (e.g., swapping SMTP providers) a single-point update.

1. Whitelist-aware containment. IP blocking and user disable actions both check against Blink Tables whitelists before acting, preventing automation from accidentally blocking legitimate infrastructure or users.

Gaps

1. Zero production executions. No workflow has recorded any execution in the last 12 months. The full library is configured but dormant — activating these automations is the single highest-priority action to realize business value from this investment.

1. Staging/production workspace drift. Several playbooks are duplicated across two workspaces (assuta_cortex_xdr vs. assuta_staging-assuta_cortex_xdr). Without a structured promotion process, these copies will diverge over time, creating a maintenance and correctness risk. A clear staging → production promotion path should be established.

1. No event-driven or scheduled automation. Every playbook except the Zendesk webhook is on_demand. There are no alert-driven, schedule-driven, or SIEM-connected automations, which means no autonomous SOC response without a human manually triggering a workflow.

1. Narrow IAM scope. The IAM use case covers only Entra ID account enable/disable and session revocation. Missing: full employee offboarding orchestration, access reviews, role assignments, JIT/temporary access, and Active Directory-native lifecycle management.

1. No vulnerability management or GRC coverage. The library has no vulnerability scanning, compliance monitoring, audit reporting, or regulatory workflow automation — categories that commonly represent high-volume, high-value automation opportunities.

1. No alert enrichment or threat intel lookups. Despite having Cortex XDR integrated, there are no workflows for automatic alert enrichment, IOC lookup, or threat intelligence ingestion — steps that typically precede containment decisions.

Integration Ecosystem