bvnt — Customer Success Report

1. Security Alert Triage & Escalation

Description: Ingests security alerts from eight or more disparate platforms, normalizes payloads, checks for duplicate events and rate-threshold violations, then creates Jira tickets and sends Slack notifications. A shared sub-flow handles Jira ticket creation with custom formatting, deduplication table writes, and Slack notification delivery for every inbound alert source.

Business problem solved: Alert fatigue from multiple disconnected security tools. Without automation, analysts manually triage alerts from email security, cloud posture, identity, and data security platforms, each with its own format and severity scale.

Integrations: Sublime Security, Microsoft Entra ID, Obsidian Security, Varonis, Wiz, Mimecast, Keeper Security, Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, Jira, Slack

2. Physical Security Monitoring

Description: Routes Verkada physical security events (camera motion triggers, access control badge events, alarms) into the same Jira/Slack alerting pipeline used for cyber alerts, providing a unified security operations view across physical and digital environments.

Business problem solved: Physical security events were siloed from the cyber SOC workflow. Connecting Verkada to the central Jira/Slack pipeline enables unified incident tracking regardless of whether the trigger is a phishing email or an unauthorized badge swipe.

Integrations: Verkada, Jira, Slack

3. Security Mailbox Automation

Description: Monitors the corporate security inbox for inbound emails from specific security vendor sources and automatically routes them to the corresponding sub-folders using per-vendor trigger criteria. A parallel workflow processes foreign travel laptop requests from Jira, applying country-based security approval logic.

Business problem solved: A high-volume shared security inbox receiving notifications from Okta, Mimecast, Jira, Palo Alto, and Cloudflare requires manual sorting. Automation keeps the inbox clean and enforces consistent categorization at scale.

Integrations: Microsoft Outlook, Okta, Mimecast, Jira, Palo Alto, Cloudflare

4. Case Management & SOAR (Internal MDR Platform)

Description: A full-stack SOC automation platform built on top of Blink's native case management module. Processes incoming CrowdStrike alerts, extracts and deduplicates observables (IPs, URLs, file hashes, usernames, email addresses), enriches them in parallel across VirusTotal, AbuseIPDB, URLScan, Okta, Entra ID, Google Workspace, and GitHub, then routes cases through specialized response subflows for phishing and malware incident types. Includes recovery workflows for unprocessed alerts and un-enriched observables.

Business problem solved: SOC analysts handling CrowdStrike and email-based alerts spend significant manual effort on observable extraction, enrichment lookups across multiple consoles, and case deduplication. This platform automates the entire triage-to-response pipeline.

Integrations: CrowdStrike, VirusTotal, AbuseIPDB, URLScan, Okta, Microsoft Entra ID, Google Workspace, GitHub, Microsoft Outlook, Slack

5. Automated Account Management & HR Systems Sync

Description: End-to-end identity lifecycle automation driven by ADP HR events. ADP changes (new hires, transfers, terminations) arrive via webhook and fan out to provision or update accounts in Okta, Microsoft Entra ID, and Mimecast. A separate AAM engine monitors lifecycle state and processes Entra-specific account creation and followup events. Supporting workflows handle manager assignment from Jira, Slack-to-Okta timezone synchronization, and Mimecast directory sync.

Business problem solved: Employee lifecycle changes originating in ADP required manual propagation to identity systems, introducing provisioning delays and de-provisioning gaps. The ADP webhook integration eliminates this lag and the AAM engine ensures cross-platform consistency.

Integrations: ADP, Okta (multiple tenants), Microsoft Entra ID, Mimecast, Slack, Jira, AWS Lambda

6. Employee Offboarding

Description: Multi-step offboarding automation that collects employee profiles from Okta, JAMF, and Microsoft Entra ID (including GDAP and onmicrosoft accounts), presents a Slack DM approval to both the triggering manager and a confirming user, then executes destructive offboarding actions: session revocation, password expiry, group removal, and device lock across all three platforms. A parallel workflow handles Salesforce-driven offboarding events. Implementations exist for both commercial and global entity environments.

Business problem solved: Offboarding required a security team member to manually coordinate across Okta, JAMF, and Entra. Missed steps left accounts active or devices unlocked. Dual-authorization via Slack ensures no offboarding runs without confirmation.

Integrations: Okta, JAMF, Microsoft Entra ID, Slack, Jira

7. GitLab SaaS Access Management

Description: Manages GitLab repository membership for employees via a Jira-driven intake. When a membership change request is submitted in Jira, the workflow validates the user against Okta, queues the request in a SaaS access waitlist table, and processes it on a weekday schedule. Supports both cloud and on-premise GitLab instances. A Panopticon event model captures all membership state changes for auditability.

Business problem solved: Developer access provisioning to GitLab repositories required manual back-and-forth between IT and security, with no queue management or audit trail. The waitlist model decouples request intake from fulfillment and ensures every change is logged.

Integrations: GitLab (cloud + on-prem), Jira, Okta, Slack

8. JIT Privileged Access Management (Portal Okta)

Description: A self-service just-in-time privileged access system for Portal Okta. Users request elevated roles via a web form with justification. The system checks current active grants, applies the role via Okta group membership, records the grant in a state table, and uses an hourly monitor to automatically revoke access when windows expire. An access cleanup workflow enforces removal and session revocation.

Business problem solved: Standing privileged access to the customer portal's Okta instance created unnecessary risk. JIT with automatic expiry enforces least-privilege without requiring manual IT involvement for every short-term access need.

Integrations: Okta, Slack

9. Customer Portal User Deprovisioning (CDP/Okta)

Description: Web form-driven workflow allowing operations staff to request bulk deletion of users from the Customer Delivery Platform (CDP) and/or Portal Okta. Requests are queued with approval state; a polling trigger detects approved records and executes the deletions. SSO troubleshooting and IdP configuration tooling lives in the same workspace.

Business problem solved: Removing inactive or churned customer users from the portal required manual coordination between ops and identity teams, with no audit trail. The approval-gated automation ensures deletions are authorized, logged, and complete.

Integrations: Okta, Slack

10. eShare Client Site & Access Management

Description: Automates the full lifecycle of eShare (SharePoint-backed secure file sharing) sites used for client deliverables. Covers provisioning new client or vendor sites with Microsoft Graph group setup and folder structure creation, a self-service access request form with Slack-delivered links, time-limited access grants with an hourly automated cleanup cycle, and a daily scanner that syncs the site inventory to a tracking table. SharePoint site monitoring runs on a daily schedule.

Business problem solved: eShare site creation required multi-step Microsoft Graph and eShare API calls performed manually by IT. Temporary access grants had no enforcement mechanism, leading to stale access accumulating over time.

Integrations: Microsoft Graph API, SharePoint, eShare, Slack

11. Threat Intelligence & Code Security

Description: Covers two threat-facing automation streams: (1) threat intelligence ingestion from OpenCTI — daily queries for email observables, domain/IP list generation, and posting to downstream parsers; (2) DLP alerting for PII and secrets detected in code repositories by Wiz, routing 2,528 findings to the security team over the past year. On-demand OSINT tooling for Entra tenant lookups and ReversingLabs IOC queries (hash, IP, URL) rounds out the use case.

Business problem solved: Threat intel feeds and code security scans produce raw findings that need processing and routing before they are actionable. Manual handling introduces delays and inconsistency.

Integrations: Wiz, OpenCTI, ReversingLabs, Microsoft Entra ID, Jira, Slack

12. B2B Customer Onboarding

Description: Self-service web form for onboarding new managed service customers into the Azure B2B tenant. Captures customer name, Salesforce ID, Azure tenant ID, region, service level, and public sector flag; generates a customer UUID; checks for existing registrations; and posts to a tracking table. A Jira-webhook variant initiates the flow from an existing ticketing process with Slack notification and Panopticon event logging.

Business problem solved: Each new B2B customer required manual Azure admin consent configuration and registration. The web form plus automated registration pipeline removes the IT dependency from an operationally critical onboarding step.

Integrations: Jira, Slack, Microsoft Azure (admin consent), Salesforce

13. IT Operations & Credential Hygiene

Description: A collection of IT hygiene automations: weekly monitoring of Okta API token expiry across corporate and portal environments with Slack alerting; daily Microsoft 365 license utilization monitoring; recurring Jira asset sync from Python-driven service; and JAMF-based Mac endpoint management including self-service lock/wipe, group assignment, and admin elevation via web form.

Business problem solved: API token expiry, license over/under-provisioning, and endpoint management tasks were handled ad hoc. Scheduled checks and self-service endpoints reduce IT toil and catch hygiene issues before they become incidents.

Integrations: Okta, Microsoft 365, Microsoft Graph, JAMF, Jira, Slack, AWS

14. GCCH Account Provisioning (Public Sector)

Description: Specialized onboarding flow for GovCloud (GCCH / CQ Fed) accounts that validates TalentLMS public sector training completion before creating a new account. Triggered from a Jira automation webhook, it checks ADP for the new hire record and verifies course completion status via the TalentLMS API before proceeding.

Business problem solved: Public sector employees require proof of compliance training before receiving GovCloud access. Without automation, verifying training completion was a manual step prone to being skipped.

Integrations: Okta, Jira, TalentLMS, ADP

15. Sec-Eng Privileged Access Management (Entra ID)

Description: On-demand tooling giving the Security Engineering team self-service, ticket-linked privileged access. A request flow captures role, service, and session length against a Jira ticket ID and logs the grant to a tracking table; a companion tool resets a user's MFA/GDAP assignment in Entra ID; a timer-based sub-flow enforces automatic removal from the Administrative Unit once the requested session length elapses.

Business problem solved: Security engineers needed ad hoc elevated access to specific roles/services and occasional Entra ID MFA/GDAP remediation, previously requiring direct admin intervention with no consistent expiry. Ticket-linked requests with automatic timer-based revocation reduce standing privileged access while giving Sec-Eng self-service speed.

Integrations: Microsoft Entra ID, Jira

16. Agentic SecEng Ticket Triage

Description: An AI agent ("SecEng Triage Engineer") triggered by inbound Jira security-engineering tickets. The workflow extracts and saves issue details, invokes the agent to analyze the request, posts the agent's findings back to the Jira ticket as a comment, and logs the agent's output to a tracking table for audit and tuning.

Business problem solved: Security Engineering ticket triage previously required a human to read, assess, and respond to every inbound Jira request. An AI triage agent now performs first-pass analysis and commentary automatically, cutting manual triage load while preserving a full audit trail of agent decisions.

Integrations: Jira

Strengths

Deep, multi-tenant identity stack. The IAM automation estate spans Okta (corporate, portal, GDAP, GCCH), Microsoft Entra ID (commercial, GovCloud, onmicrosoft), JAMF, and ADP — all wired into a shared event bus. The AAM engine and ADP webhook sync represent a mature, production-grade identity lifecycle pipeline processing thousands of events per year.

Unified alert pipeline across cyber and physical. All security alert sources — email security, cloud posture, identity, data security, and physical access control — feed through the same JIRA/Slack sub-flow with shared deduplication and threshold logic. This yields consistent ticket formatting and a single pane of glass regardless of source, processing over 11,000 combined alert and dedup events in 12 months.

JIT enforcement at scale. The Portal Okta JIT system with automated hourly revocation represents a genuine least-privilege implementation, not just a policy. 963 automated access removal monitor executions over the year demonstrate ongoing enforcement rather than a one-time setup.

eShare lifecycle ownership. The complete create → request → enforce expiry → inventory cycle for eShare client sites is a well-designed closed-loop automation. 963 hourly cleanup runs and 285 fulfilled access requests show this is operationally active.

PII/secrets detection in code. 2,528 Wiz code scanning alerts routed and actioned in 12 months indicates active DevSecOps integration — this is a signal of a mature security program applying shift-left controls.

Agentic triage now live for Sec-Eng tickets. The new SecEng Triage Agent uses an AI agent to analyze inbound Jira security-engineering tickets and auto-comment triage findings, with 40 executions in its first stretch of use — a concrete first step toward the agentic SOC model, distinct from the still-dormant CrowdStrike-based MDR platform noted below.

Gaps

Case Management & SOAR platform shows zero executions. The internal MDR platform (24 workflows covering CrowdStrike alert processing, observable enrichment, and phishing/malware response) has not run in the past 12 months. This is either a pre-production deployment awaiting activation, or it was stood down. The enrichment library (VirusTotal, AbuseIPDB, URLScan, CrowdStrike) is well-structured and ready to activate.

Employee offboarding is underutilized relative to org size. The main offboarding automation (commercial and global combined) shows only 30 executions. Given the scale of the ADP sync (1,387 hire/change events), a significant deprovisioning gap likely exists. The Salesforce-triggered offboarding (7 runs) only covers one HR system trigger path.

B2B and GCCH onboarding workflows are dormant. Zero executions across all B2B customer onboarding and public sector provisioning workflows. These may be in staging, replaced by other processes, or triggered via paths not captured in the execution data.

ReversingLabs IOC portal has never been used in production. The "Joesneyland" analyst IOC lookup tool (hash, IP, URL via ReversingLabs) has zero executions despite being a fully built interactive web form tool. Analyst awareness or integration into the SOC workflow may be missing.

Conquest Commercial alert sources are inactive. Both Defender for Cloud Apps and Defender for Endpoint polling triggers for Conquest Commercial show zero executions — either the integrations are not connected or the tenant has no alerts flowing.

Integration Ecosystem