BDOMDR — Customer Success Report

All 93 workflows recorded 0 executions in the reporting window (July 2025 – July 2026). This indicates workflows are deployed but not yet running in production — likely due to trigger activation, integration connection setup, or telemetry collection timing. The KPI table reflects deployment scope rather than realized throughput.

1. ArcSight SOC Alert Pipeline

Description: End-to-end ingestion of ArcSight SIEM events into Blink Case Management. The pipeline polls ArcSight Query Viewers for both Alert and DSM event types, deduplicates against existing records using an MSSQL automation-closing database, and creates or links alerts and cases automatically.

Business problem solved: Eliminates manual log review from ArcSight consoles; SOC analysts work from a unified Blink case queue rather than raw SIEM output, with deduplication preventing alert fatigue from repeat events.

Category: SOC | Subcategories: SIEM & log pipeline monitoring, Case mgmt & SOAR

Integrations: ArcSight, Microsoft SQL, Blink Case Management, Blink Tables

2. Zendesk SOC Ticketing

Description: Automated creation of Zendesk tickets from SOC alert events, including pre-population of ticket fields: priority mapping from event severity, rule descriptions from MSSQL, ELK evidence-of-incident links, XDR incident correlation, and VIP user flags.

Business problem solved: Removes manual ticket creation from the SOC escalation path; ensures every alert that reaches escalation threshold generates a properly formatted Zendesk ticket without analyst intervention.

Category: SOC | Subcategories: Case mgmt & SOAR

Integrations: Zendesk, Microsoft SQL, Cortex XDR, Elasticsearch

3. Alert Enrichment & IOC Lookup

Description: A suite of enrichment subflows invoked during SOC triage to gather context on IPs, file hashes, user identities (source/destination, VIP status), endpoint state, open XDR incidents, and ELK evidence of interest. VirusTotal provides hash and URL verdicts with a result-caching layer.

Business problem solved: Reduces analyst research time per alert by automatically surfacing device context, user risk tier, threat intelligence verdicts, and correlated XDR incident data directly into the case record before an analyst reviews it.

Category: SOC | Subcategories: Alert enrichment / IOC lookup

Integrations: VirusTotal, Cortex XDR, Cortex Xpanse, Elasticsearch, ArcSight, MySQL (ESM-GER-2, ESM-GER-3, ESM-Carl)

4. EDR Containment & Response

Description: On-demand and webhook-triggered endpoint containment using Cortex XDR. Supports manual isolation requests, automated isolation via webhook (triggered from Zendesk ticket comments), endpoint scanning, and hash-level blocking and whitelisting across multiple customer XDR connections.

Business problem solved: Compresses endpoint containment from minutes to seconds by removing the manual XDR console step; supports both analyst-initiated actions and automated isolation triggered by external ticketing system events.

Category: SOC | Subcategories: EDR containment & response

Integrations: Cortex XDR, Slack, Zendesk

5. Network & Domain Blocking

Description: Automated enforcement actions across Zscaler ZIA (URL/domain blocking via DenyList) and Palo Alto Networks Firewall (IP blocking across specified network locations). Supports on-demand analyst triggers and creates ServiceNow incidents as a blocking audit trail.

Business problem solved: Closes the gap between threat intelligence identification and network enforcement; a malicious domain or IP can be pushed to perimeter controls without requiring a firewall admin or ZIA console access.

Category: SOC | Subcategories: EDR containment & response

Integrations: Zscaler ZIA, Palo Alto Networks, ServiceNow

6. Outbound Escalation (Twilio)

Description: Automated phone and SMS escalation for high-severity SOC events. Looks up the appropriate on-call contact from the MSSQL notification database, then dispatches outbound calls or SMS messages via Twilio based on the alert rule and customer context.

Business problem solved: Ensures critical alerts reach the right personnel immediately without requiring an analyst to manually identify and dial the on-call contact; removes the last manual step in the critical-alert notification chain.

Category: SOC | Subcategories: Case mgmt & SOAR

Integrations: Twilio, Microsoft SQL

7. ZD ↔ ServiceNow Bidirectional Sync

Description: A full bidirectional synchronization layer between Zendesk and ServiceNow. Handles ticket creation, comment sync, status and priority sync, attachment sync, and ticket closure in both directions. Supports multiple customer ServiceNow instances via a dynamic connection map stored in Blink Tables; V3 architecture adds try/catch error handling throughout.

Business problem solved: Eliminates manual double-entry and status drift between the MDR's Zendesk instance and managed customers' ServiceNow instances; both systems reflect the same ticket state in real time without any human relay.

Category: Other | Subcategories: IT helpdesk & ticket routing

Integrations: Zendesk, ServiceNow (multi-tenant), Blink Tables

8. MDR Staff Onboarding

Description: Fully automated onboarding of new MDR staff members across all required platforms. A single orchestrator triggers simultaneous provisioning across Active Directory (LDAP), Microsoft Entra ID (with external guest invite), DUO MFA, Elasticsearch SOC, Zendesk, AWS Workspaces, and Cisco Umbrella across two managed network tenants.

Business problem solved: Reduces new hire platform provisioning from hours of manual work across eight systems to a single triggered workflow; eliminates provisioning gaps that create security blind spots or delayed analyst access.

Category: IAM | Subcategories: Employee onboarding, Full employee lifecycle

Integrations: LDAP/Active Directory, Microsoft Entra ID, DUO, Elasticsearch, Zendesk, AWS, Cisco Umbrella

9. MDR Staff Offboarding

Description: Mirrors the onboarding stack in reverse — a single orchestrator triggers deprovisioning and suspension across all MDR platforms simultaneously: AD disable, Entra ID removal, DUO deprovisioning, Elasticsearch access revocation, Zendesk suspension, AWS Workspace deletion, and Cisco Umbrella removal across both tenants.

Business problem solved: Prevents access persistence after termination across eight systems; ensures offboarding is complete and auditable in a single automated pass without relying on manual checklists.

Category: IAM | Subcategories: Employee offboarding, Full employee lifecycle

Integrations: LDAP/Active Directory, Microsoft Entra ID, DUO, Elasticsearch, Zendesk, AWS, Cisco Umbrella

10. Asset Inventory & Correlation

Description: Cross-source asset correlation that joins endpoint records from Qualys, Cortex XDR, and ServiceNow into a unified asset table in Blink. SQL queries then surface coverage gaps — assets visible in one source but absent from another — across all three.

Business problem solved: Provides a single reconciled asset inventory without a dedicated CMDB integration; surfaces security coverage gaps where endpoints are known to IT (ServiceNow) but not enrolled in the EDR or vulnerability scanner.

Category: Cloud Security | Subcategories: Cloud asset coverage & inventory

Integrations: Qualys, Cortex XDR, ServiceNow, Blink Tables

11. Vulnerability Remediation

Description: ServiceNow-triggered remediation workflows that cross-reference CVE data from ServiceNow incidents against endpoint inventory in Cortex XDR. Multiple remediation variants handle different scenarios; a file download utility extracts remediation artifacts from ServiceNow attachments.

Business problem solved: Automates the cross-referencing step in vulnerability remediation — matching CVE findings from ticketed incidents to affected XDR endpoints — so remediation owners receive pre-populated endpoint lists rather than conducting manual asset queries.

Category: Vulnerability Mgmt | Subcategories: CVE lookup & remediation, Vuln lifecycle prioritize & ticket

Integrations: ServiceNow, Cortex XDR

12. Attack Surface Management

Description: External attack surface discovery and SIEM sensor health monitoring. CyCognito enumerates externally exposed assets, while the DSM workflow detects devices that have stopped reporting to the SIEM and creates Zendesk tickets to track remediation.

Business problem solved: Automates external exposure discovery and SIEM sensor gap detection, catching both unknown external assets and silent sensors before they create coverage blindspots or SLA violations.

Category: Vulnerability Mgmt | Subcategories: Threat hunting & detection, Vuln scan lifecycle automation

Integrations: CyCognito, Zendesk

13. Platform Utilities & Infrastructure

Description: Shared utility subflows and administrative tooling that underpin the SOC pipeline, enrichment chain, and ZD-SNOW sync. Includes MSSQL routing lookups (rule details, notification contacts), text normalization utilities, event-source classifiers, and admin tools for data management and integration setup.

Business problem solved: Provides reusable logic components that keep the main SOC workflows clean and maintainable; centralizes volatile configuration (on-call contacts, rule metadata, severity mappings) in queryable MSSQL tables rather than hardcoded workflow logic.

Category: SOC | Subcategories: Case mgmt & SOAR

Integrations: Microsoft SQL, Elasticsearch, Google Sheets, Zendesk, AWS, SMTP

Strengths

Architecturally complete SOC ingestion pipeline. The numbered ArcSight sequence (1 → 2 → 3 → 5 → 6) represents a well-designed ingestion-to-escalation flow covering SIEM polling, deduplication, case creation, enrichment, and Zendesk ticketing in a single automation chain. The MSSQL-backed rule and notification databases make the pipeline configurable without touching workflow logic.

Comprehensive MDR employee lifecycle automation. The onboarding and offboarding stacks cover 8 distinct systems each in a single orchestrated flow: AD/LDAP, Entra ID, DUO, Elasticsearch, Zendesk, AWS Workspaces, and dual Cisco Umbrella tenants. This is operationally mature and reflects a security-first identity hygiene posture — every new analyst is fully provisioned, every departure is fully revoked, in one click.

Production-grade bidirectional ITSM sync. The 14-playbook ZD↔ServiceNow V3 integration handles the full ticket lifecycle in both directions — creation, comments, attachments, status, priority, and closure — with multi-tenant ServiceNow support and try/catch error handling throughout. This is a high-complexity integration that typically requires significant custom code; the Blink implementation is fully no-code and multi-customer.

Multi-layer containment capability. The estate covers active response from four vectors simultaneously: endpoint (Cortex XDR isolation), network (Palo Alto IP blocking), DNS/web (Zscaler ZIA domain blocking), and file hash (XDR block list). Few MSSP platforms have pre-built containment automation spanning all four layers.

VIP-aware enrichment. The SOC enrichment chain includes dedicated VIP user checks for both source and destination users — a detail that directly maps to client SLA prioritization requirements and shows depth of operational design.

Gaps & Opportunities

No recorded executions — activation audit needed. All 93 workflows show 0 executions in the 12-month window. This is the most significant gap to address before deriving ROI metrics. Root causes to investigate: (a) are scheduled/event triggers enabled and connected to live data sources, (b) are integration connections validated and authenticated, (c) does the telemetry collection window post-date the deployment date.

Remediation workflows are undifferentiated. Remediation 2, 3, and 4 share near-identical structures (ServiceNow + Cortex XDR cross-reference) with names that don't distinguish their scope or trigger conditions. A consolidation pass could reduce these to a single parameterized workflow, improving maintainability and making execution metrics meaningful.

No CSPM automation deployed. Despite a broad SOC and IAM footprint, there are no cloud security posture workflows (AWS Config, Microsoft Defender for Cloud, Prisma). Given the existing AWS integration for Workspaces and EC2 lifecycle management, expanding into cloud configuration compliance monitoring is a natural next step.

Threat intelligence loop is open-ended. VirusTotal enrichment is deployed and VirusTotal verdicts surface in alert context, but there is no automated write-back: a confirmed-malicious verdict from VT does not automatically trigger a ZIA domain block or XDR hash block. Closing this loop would turn enrichment into active defense.

Asset correlation limited to three sources. The Qualys + XDR + ServiceNow correlation is solid, but cloud-native workloads (EC2 instances, serverless) are absent. Adding AWS EC2 inventory — which is already connected for Workspaces — would extend coverage visibility to cloud infrastructure.

Integration Ecosystem