HIQA — Customer Success Report

Total playbooks: 1

Total executions (last 12 months): 0

Azure Hybrid Infrastructure Control

Description: On-demand command execution and status inspection across Azure ARC-managed hybrid machines. Enables operators to query machine state and act on the result without direct shell access to the endpoint.

Business problem solved: Provides a governed, auditable mechanism to retrieve status from and execute commands on hybrid cloud machines enrolled in Azure ARC, removing the need for direct RDP/SSH sessions and adding conditional branching logic around machine state.

Category: Cloud Security

Subcategory: Cloud asset coverage & inventory

Integrations: Azure (Azure ARC / Hybrid Machines)

Trigger: On-demand (manual invocation with Action and Hostname inputs)

Playbooks

Workflow logic summary:

1. Accepts Action and Hostname as inputs
2. Calls azure.GetHybridMachine to retrieve the machine's current status from the Azure ARC control plane
3. Branches on machine state via internal.ifCondition
4. Prints result

Strengths

• Azure ARC integration is in place. The foundational connection to Azure ARC hybrid machine management is configured and connected (hiqa_hiqa_prod_sub01), which positions the team to extend this workflow into richer asset inventory and remediation patterns.
• Conditional logic is present. The workflow already includes branching on machine state, demonstrating the pattern needed for more sophisticated response automation.

Gaps

• Zero production executions. The single deployed workflow has not run in the last 12 months. This strongly suggests it was built for a one-off or exploratory use case and has not been adopted into a repeatable operational process, or that it is pending rollout.
• Extremely limited workflow coverage. With only one workflow in the dataset, HIQA has not yet adopted Blink across the broader security and IT automation surface. Peer customers at a similar stage typically have 10–50+ active workflows spanning SOC triage, IAM lifecycle, and vulnerability management.
• No SOC or IAM automation. There are no workflows covering alert triage, phishing response, identity lifecycle, or access review — all high-ROI categories for a healthcare/public-sector organization handling sensitive data.
• No GRC or compliance automation. Organizations subject to healthcare compliance frameworks (e.g., GDPR, ISO 27001, HSE requirements) typically benefit heavily from automated compliance evidence collection and control monitoring.

Integration Ecosystem

The integration footprint is minimal. Expanding to Azure AD / Entra ID, endpoint management (Defender, Intune), and ticketing (ServiceNow, Jira) would unlock the most common high-value use cases.

Recommended Next Steps

1. Confirm deployment status of the Azure ARC workflow — if it is live but simply hasn't been triggered, instrument a scheduled or event-driven trigger.
2. Identify the top 3 manual security processes the team runs today (e.g., user offboarding, alert investigation, vulnerability reporting) and target those for automation first.
3. Explore IAM lifecycle automation — employee onboarding/offboarding is typically the fastest path to measurable ROI in organizations of HIQA's profile.

Total playbooks: 1

Total executions (last 12 months): 0

Azure Hybrid Infrastructure Control

Description: On-demand command execution and status inspection across Azure ARC-managed hybrid machines. Enables operators to query machine state and act on the result without direct shell access to the endpoint.

Business problem solved: Provides a governed, auditable mechanism to retrieve status from and execute commands on hybrid cloud machines enrolled in Azure ARC, removing the need for direct RDP/SSH sessions and adding conditional branching logic around machine state.

Category: Cloud Security

Subcategory: Cloud asset coverage & inventory

Integrations: Azure (Azure ARC / Hybrid Machines)

Trigger: On-demand (manual invocation with Action and Hostname inputs)

Playbooks

Workflow logic summary:

1. Accepts Action and Hostname as inputs
2. Calls azure.GetHybridMachine to retrieve the machine's current status from the Azure ARC control plane
3. Branches on machine state via internal.ifCondition
4. Prints result

Strengths

• Azure ARC integration is in place. The foundational connection to Azure ARC hybrid machine management is configured and connected (hiqa_hiqa_prod_sub01), which positions the team to extend this workflow into richer asset inventory and remediation patterns.
• Conditional logic is present. The workflow already includes branching on machine state, demonstrating the pattern needed for more sophisticated response automation.

Gaps

• Zero production executions. The single deployed workflow has not run in the last 12 months. This strongly suggests it was built for a one-off or exploratory use case and has not been adopted into a repeatable operational process, or that it is pending rollout.
• Extremely limited workflow coverage. With only one workflow in the dataset, HIQA has not yet adopted Blink across the broader security and IT automation surface. Peer customers at a similar stage typically have 10–50+ active workflows spanning SOC triage, IAM lifecycle, and vulnerability management.
• No SOC or IAM automation. There are no workflows covering alert triage, phishing response, identity lifecycle, or access review — all high-ROI categories for a healthcare/public-sector organization handling sensitive data.
• No GRC or compliance automation. Organizations subject to healthcare compliance frameworks (e.g., GDPR, ISO 27001, HSE requirements) typically benefit heavily from automated compliance evidence collection and control monitoring.

Integration Ecosystem

The integration footprint is minimal. Expanding to Azure AD / Entra ID, endpoint management (Defender, Intune), and ticketing (ServiceNow, Jira) would unlock the most common high-value use cases.

Recommended Next Steps

1. Confirm deployment status of the Azure ARC workflow — if it is live but simply hasn't been triggered, instrument a scheduled or event-driven trigger.
2. Identify the top 3 manual security processes the team runs today (e.g., user offboarding, alert investigation, vulnerability reporting) and target those for automation first.
3. Explore IAM lifecycle automation — employee onboarding/offboarding is typically the fastest path to measurable ROI in organizations of HIQA's profile.