binnys — Customer Success Report

1. Employee Offboarding Automation

Category: IAM

Subcategories: Employee offboarding, Identity lifecycle automation, Identity sync & directory mgmt

Description: End-to-end automation of employee offboarding, triggered by a Freshservice ITSM ticket and orchestrated across Active Directory, Microsoft Entra ID, and UKG Pro HCM. Blink deactivates accounts, terminates sessions, verifies SSO status, and manages scheduled batch offboarding jobs without manual IT intervention.

Business problem solved: Manual offboarding across disparate HR and identity systems is error-prone, slow, and creates security risk when access is not revoked promptly after an employee's departure.

Integrations: Freshservice, Active Directory (WinRM + PowerShell), Microsoft Entra ID, UKG Pro HCM, Blink Tables

2. Identity Threat Detection & Response

Category: SOC

Subcategories: Identity threat response, Alert enrichment / IOC lookup, Case mgmt & SOAR

Description: Detects and responds to identity-based threats in Microsoft Entra ID — investigating risky user flags, pulling sign-in logs, revoking active sessions, dismissing risk after remediation, and escalating confirmed incidents to Teams and Jira. Provides an automated first-response loop for compromised account scenarios.

Business problem solved: Identity-based attacks are the leading entry point for breaches. Without automation, analysts must manually cross-reference Entra risky-user signals, pull sign-in history, revoke sessions, and file change tickets — a process that can take hours per incident.

Integrations: Microsoft Entra ID, Microsoft Teams, Jira

3. Alert Enrichment & IOC Investigation

Category: SOC

Subcategories: Alert enrichment / IOC lookup, EDR containment & response

Description: A comprehensive library of enrichment playbooks that automatically look up indicators of compromise — IPs, hashes, URLs, domains, email addresses, and usernames — across CrowdStrike, VirusTotal, AbuseIPDB, URLScan, Okta, Microsoft Entra ID, Google Workspace, Slack, and GitHub. Also includes device status lookups against Active Directory and Microsoft Defender for Endpoint. These playbooks serve as the enrichment backbone for the SOAR platform.

Business problem solved: Manual IOC investigation requires analysts to context-switch across 8–12 consoles per alert. This enrichment library automates the data-gathering phase so analysts receive pre-populated context rather than starting from scratch.

Integrations: Active Directory, Microsoft Defender for Endpoint, CrowdStrike Falcon, VirusTotal, AbuseIPDB, URLScan, Okta, Google Workspace, Microsoft Entra ID, Slack, GitHub, Whois, dig/DNS

4. SOAR Case Management Platform

Category: SOC

Subcategories: Case mgmt & SOAR, SIEM & log pipeline monitoring, Phishing detection & response, EDR containment & response

Description: A full Blink-native SOAR platform encompassing alert ingestion from six sources, observable extraction and deduplication, automated enrichment routing, phishing and malware response subflows, and a library of case management utilities. Provides the operational backbone for tier-1 SOC triage with zero executions in the measurement window — indicating the platform is built and configured but awaiting production alert volume activation.

Business problem solved: Building a custom SOAR without a dedicated platform requires expensive licensing and long implementation cycles. This use case demonstrates a fully self-built SOAR running entirely on Blink, covering the complete alert-to-case lifecycle.

Integrations: Blink Case Management, CrowdStrike Falcon, Microsoft Defender for Cloud Apps, Azure Monitor, AWS CloudTrail, Wiz, Microsoft Outlook, Email

5. EDR Containment & Endpoint Response

Category: SOC

Subcategories: EDR containment & response

Description: Playbooks for remote endpoint containment and command execution via CrowdStrike Falcon Real Time Response (RTR). Supports both single-host and bulk-host quarantine/de-quarantine operations and ad-hoc command execution over live sessions.

Business problem solved: Containment of compromised endpoints requires rapid, repeatable action that bypasses manual console access. These playbooks enable one-click or automated quarantine directly from a case without requiring direct CrowdStrike console access.

Integrations: CrowdStrike Falcon (RTR)

6. Network Infrastructure Hygiene

Category: Other

Subcategories: IT/OT & network infra monitoring

Description: Automates DNS zone auditing and stale record remediation, and provisions store-location network infrastructure in Netbox (IPAM/DCIM) — pulling store records from Microsoft SQL Server into Blink Tables and using them to create corresponding sites, locations, and IP subnets in Netbox. Together these playbooks keep DNS and network documentation synchronized with the authoritative store database as locations are added or change.

Business problem solved: Stale DNS records are a persistent hygiene issue that can be exploited for subdomain takeovers or create confusion in incident investigations, and manually creating Netbox sites/locations/subnets for each store is a repetitive, error-prone task. Automating both keeps network infrastructure records accurate without manual upkeep.

Integrations: DNS Dumpster, PowerShell / WinRM, Netbox, Microsoft SQL Server, Blink Tables

7. Security Documentation & Audit Trail

Category: GRC

Subcategories: Security metrics & reporting, DevSecOps compliance

Description: A scheduled weekly automation that inventories all Blink workflows modified in the prior week, extracts their YAML definitions, converts them to human-readable documentation, and publishes the output to SharePoint. Provides a continuous, tamper-evident audit trail of automation logic changes for compliance and governance purposes.

Business problem solved: Security automation logic is often undocumented, creating audit risk and knowledge gaps during staff transitions or regulatory reviews. This use case produces automated, version-tracked documentation on a fixed schedule without analyst involvement.

Integrations: Blink API, SharePoint

8. Privileged Access Management Integration

Category: IAM

Subcategories: Privileged account mgmt, Password & credential lifecycle

Description: Integration with Delinea Secret Server (PAM vault) for retrieving and storing privileged credentials. Beyond the initial test connection, this now includes generating and vaulting SFTP service-account passwords for EDI trading-partner access (with matching SSH provisioning and rsyslog configuration), and retrieving vaulted Token2 hardware OTP seed files to provision multi-factor authenticators directly into Microsoft Entra ID.

Business problem solved: Hardcoded credentials in automation are a critical security risk. Integrating Delinea allows automated workflows to retrieve secrets at runtime from a managed vault and push credentials or MFA seeds into downstream systems (SSH/SFTP servers, Entra ID) without manual handling, enforcing least-privilege and full audit logging of credential access.

Integrations: Delinea Secret Server, WinRM, SSH, Microsoft Entra ID

9. Store Identity & Access Administration

Category: IAM

Subcategories: Identity lifecycle automation, Access review & group mgmt

Description: Automates the identity and access scaffolding required to stand up a new store location — creating a dedicated Microsoft Entra ID administrative unit per store and maintaining group membership for store-level password-reset delegation. Runs alongside the Netbox network provisioning pipeline to fully provision a new store's identity footprint from a single store record.

Business problem solved: As Binny's opens or updates store locations, IT and identity administrators must manually create delegated administrative scopes and manage local password-reset group membership per site — a repetitive, error-prone task when done by hand across dozens of retail locations.

Integrations: Microsoft Entra ID, Blink Tables

Strengths

IAM offboarding is the production anchor. The employee offboarding use case has the highest execution volume (24 runs across 4 active playbooks) and the tightest integration footprint — Freshservice → Blink → AD/Entra/UKG. The webhook-triggered Create Offboarding Job running 12 times indicates a real operational dependency on Blink for identity lifecycle management.

Identity threat response is fully operational. The MSFT risky-user workflow cluster (Get Risky User Details, Dismiss User Risk, List Sign-Ins) shows consistent use across 9 executions in the measurement window. The presence of a Jira change-request automation in the same workspace suggests a structured remediation workflow is in place.

Broad enrichment library built, ready to activate. 28 distinct enrichment playbooks span 12 integration sources — CrowdStrike, VirusTotal, AbuseIPDB, URLScan, Okta, Entra ID, Google Workspace, Slack, GitHub, Whois, dig. This is a production-ready enrichment layer that accelerates SOAR activation significantly.

Self-documenting automation practice. The weekly documentation workflow publishing to SharePoint is a differentiated governance practice — few organizations auto-document their automation logic for audit. 5 runs indicate this has been consistently running since deployment.

Gaps & Opportunities

SOAR platform built but not ingesting live alerts. 28 case management playbooks — including 6 source ingestion templates (CrowdStrike, Defender for Cloud Apps, Azure, AWS CloudTrail, Wiz), the full deduplication/enrichment/response pipeline — show zero executions. The infrastructure is fully built; the gap is activating the ingest connectors with production alert sources. This represents significant latent value ready to unlock.

EDR containment playbooks are dormant. CrowdStrike RTR capabilities (single host, batch, quarantine) are built but unused. These should be wired into the malware response subflow or made available as case actions to enable automated containment in the existing SOAR pipeline.

PAM integration has moved past proof-of-concept but is not yet running in production. Delinea now backs two real provisioning workflows — EDI SFTP account creation and Token2 MFA seed provisioning into Entra ID — beyond the original test playbook, but all three show zero executions. Operationalizing these would eliminate hardcoded credentials and manual MFA seeding from onboarding workflows, a low-effort, high-security-value maturity step.

Store network and identity provisioning is built but not yet activated. Seven new playbooks — pulling store records from Microsoft SQL Server and using them to provision Netbox sites/locations/subnets, Entra ID administrative units, and password-reset group membership — form a complete new-store provisioning pipeline. Only one playbook (password-reset group membership) has recorded executions so far; the rest are likely awaiting the next store opening or rollout milestone to trigger.

No phishing or cloud security coverage active. The phishing response subflow and all cloud security ingestion (Wiz, Azure, AWS CloudTrail) show zero executions. Given that Binnys has Wiz and CrowdStrike in the environment, activating those ingest triggers is a near-term expansion opportunity.

Integration Ecosystem