buckle — Customer Success Report

1. LogRhythm SIEM Ingestion & Automated Response

Description: Ingests every alert fired from LogRhythm via webhook, enriches each event's drilldown fields against Microsoft Entra ID, CrowdStrike, and Okta, and auto-executes response playbooks (e.g., forced password reset for vulnerable-credential detections) — all without analyst touch.

Business problem solved: LogRhythm generates high-alert volume that previously required manual triage; Blink intercepts every event, enriches it in real time, and acts on high-confidence detections automatically.

Category: SOC | Subcategories: SIEM & log pipeline monitoring, Case mgmt & SOAR

Key integrations: LogRhythm (webhook), Microsoft Entra ID, CrowdStrike, Okta, Microsoft Graph, WinRM (AD password reset)

2. Agentic SOC — Multi-Source Alert Processing & Case Management

Description: A full Blink-native SOAR platform that ingests alerts from CrowdStrike and Microsoft Defender, extracts and deduplicates observables, enriches IOCs across threat intel sources, routes each alert to the appropriate response playbook (ATO, lateral movement, phishing, malware), and syncs case closures back to source tools — running continuously on a 1-minute polling interval.

Business problem solved: The security team needed a vendor-agnostic case management and response orchestration layer that ties together CrowdStrike, Defender, and LogRhythm signals without relying on a dedicated SIEM-native SOAR product.

Category: SOC | Subcategories: Case mgmt & SOAR, Agentic SOC, EDR containment & response, Identity threat response

Key integrations: CrowdStrike, Microsoft Defender/XDR, Microsoft Entra ID, Microsoft Outlook, Slack, Blink Case Management

3. Alert Enrichment & IOC Lookup

Description: A library of on-demand enrichment playbooks that automatically look up every observable type (IP, hash, URL, email, username, domain, agent ID, hostname) across a wide array of threat intelligence and identity sources. These playbooks are called by the SOAR engine during alert processing and are also available standalone.

Business problem solved: Manually cross-referencing observables across eight or more tools during triage added hours per incident; this library enables instant, automated enrichment of every observable the moment it enters a case.

Category: SOC | Subcategories: Alert enrichment / IOC lookup

Key integrations: CrowdStrike, VirusTotal, AbuseIPDB, URLScan, WhoIs (bash), IPWhois.io, Microsoft Entra ID, Okta, Google Workspace, GitHub, Slack, Dig (bash), Abnormal Security

4. Account Takeover & Identity Threat Investigation

Description: An analyst-facing toolkit for investigating suspected account compromises, including AI-assisted user risk assessment (Blink AI Agent "Risky Ricky"), ad-hoc MFA challenges sent via Entra, login history retrieval, and a Slack-native help-desk integration for real-time lockout triage.

Business problem solved: Help desk staff and security analysts needed a fast, structured way to assess whether a locked-out or suspicious user account represented a genuine compromise versus a benign lockout — without pulling data from multiple consoles manually.

Category: SOC | Subcategories: Identity threat response, Agentic SOC

Key integrations: Microsoft Entra ID, Microsoft Graph, Slack, Blink AI Agents, PowerShell/WinRM, Okta

5. EDR Containment & Identity Lockdown

Description: A complete endpoint containment toolkit built on CrowdStrike Falcon RTR, supporting endpoint isolation and de-isolation by username, hostname, device ID, or transaction ID — with MFA-gated confirmation via Slack before any destructive action. Also includes identity lockdown capabilities (disable account, reset password, revoke sessions) for use during active incidents.

Business problem solved: Incident responders needed a repeatable, auditable, MFA-protected workflow for isolating compromised endpoints across the retail environment without direct CrowdStrike console access during fast-moving incidents.

Category: SOC | Subcategories: EDR containment & response, Identity threat response

Key integrations: CrowdStrike Falcon, Microsoft Entra ID, Slack, WinRM (AD operations)

6. WAF & Web Filtering Policy Management

Description: On-demand and Slack-triggered workflows that allow the security team to update Fastly NGWAF allowlists (corp-level and site-level) and manage Zscaler ZIA URL blocklists — with IP validation built in before any change is committed.

Business problem solved: Security engineers needed a safe, auditable way to update WAF allowlists for legitimate business traffic (e.g., POS systems, traveling staff) and block malicious URLs during active incidents, without granting direct console access to tier-1 responders.

Category: Cloud Security | Subcategories: Cloud access & SaaS policy mgmt

Key integrations: Fastly NGWAF, Zscaler ZIA, Slack

7. JIT Temporary Access — Conditional Access Exception (CA014)

Description: A self-service web form allows authorized users to request temporary exemption from Conditional Access policy CA014 for a specific travel window; the user is automatically added to the exception group and a nightly scheduled job removes them at midnight on the last day of travel.

Business problem solved: Traveling employees frequently triggered CA014 blocks when authenticating from non-standard locations, requiring manual IT intervention; this process automates the full request-to-expiration lifecycle with zero IT involvement.

Category: IAM | Subcategories: JIT & temporary access

Key integrations: Microsoft Entra ID, Slack, Blink Tables, Blink Web Form

8. Identity Lifecycle & Employee Provisioning

Description: End-to-end employee lifecycle management driven by UKG Pro HCM: retrieves new-hire and termination records, checks email address availability in Entra ID, creates Entra admin accounts with manager assignment, provisions and deprovisions group memberships, disables accounts and revokes sessions on departure, and syncs user attribute changes (department, title, manager) through LDAP and WinRM.

Business problem solved: IT operations needed to eliminate manual account creation and deactivation steps for new hires, internal transfers, and departures, reducing provisioning/deprovisioning time and ensuring attribute and access consistency across on-prem Active Directory, Entra ID, and HR records.

Category: IAM | Subcategories: Employee onboarding, Employee offboarding, Identity lifecycle automation

Key integrations: UKG Pro HCM, Microsoft Entra ID, Microsoft Graph, LDAP, WinRM, Slack

9. Email Notification Delivery

Description: An on-demand utility that sends HTML-formatted email content through the organization's on-premises SMTP relay, supporting configurable sender, recipient, and subject parameters with file-based HTML content.

Business problem solved: Other automations and manual processes needed a standardized way to deliver formatted HTML reports and notifications through the internal mail relay without duplicating SMTP logic in every playbook.

Category: Other | Subcategories: SaaS / IT administration

Key integrations: On-prem SMTP server

Strengths

Deep, production-grade SOAR platform. The LogRhythm + Blink Case Management stack is the clearest indicator of mature automation: 2,390 SIEM events ingested, 1,944 vulnerability responses executed, and 800 alerts processed through a full extract-enrich-deduplicate-respond pipeline. This is not exploratory automation — it is core SOC infrastructure.

Multi-source EDR integration running at scale. CrowdStrike (Falcon webhook) and Microsoft Defender (polling, every 5 minutes) feed into the same SOAR pipeline, giving a unified case management view across both EDR products. The 446 case closures synced back to source tools confirm the bidirectional integration loop is closed.

Account takeover response is the heaviest automated response path. 372 ATO incident responses were dispatched through the automated response router, each triggering IP geolocation (IPWhois), user login history retrieval, and NIC history lookups — indicating the ATO playbook is the primary threat scenario being actioned at scale.

WAF management via Slack is a genuine force multiplier. 47 Fastly NGWAF allowlist and IP-list changes were applied on-demand through a Slack-triggered workflow with built-in IP validation. This gives tier-1 staff the ability to make controlled WAF changes during incidents without console access.

MFA-gated containment is built and ready. Every endpoint isolation playbook (isolate by username, hostname, device ID) requires MFA confirmation via Entra before executing — a security control that prevents misuse. These playbooks have 0 executions, meaning the capability exists as a rapid-response tool that has not yet been needed in production.

CA014 JIT access runs autonomously. The traveling-user exception workflow — web form intake, group membership, nightly expiration — ran 40 times in 12 months with no IT intervention. The lifecycle is fully self-contained.

Password reset automation scaled sharply. A newly deployed instance of Reset Password + force reset on next login accounted for 242 of the 251 combined executions across all three workspace instances of this playbook — making credential reset one of the highest-volume identity remediation actions on the platform, alongside the LogRhythm vulnerable-password response path.

Gaps & Opportunities

Phishing and malware response playbooks are built but inactive. Both Response Subflow — Phishing and Response Subflow — Malware have 0 executions despite being wired into the SOAR router. If phishing/malware alerts are reaching the platform, the alert template mappings may not be routing to these playbooks. If they are not reaching the platform, there is an untapped ingestion opportunity (e.g., ProofPoint, MSFT Defender for Office 365).

Enrichment library has broad coverage but low utilization for non-Whois sources. The enrichment library spans VirusTotal, AbuseIPDB, URLScan, Okta, Google Workspace, and GitHub — but these all show 0 executions. Only Whois (36 execs), Microsoft Entra ID (62 execs), CrowdStrike (9 execs), and IPWhois (372 execs) are active. Expanding the observable extraction templates to include URL and hash types would activate the existing VirusTotal and URLScan playbooks automatically.

UKG-driven employee lifecycle automation has not yet launched. The full UKG Pro HCM → Entra ID pipeline now spans both onboarding (hire date trigger, email check, account creation, manager assignment, group provisioning) and offboarding (termination trigger, group snapshot, account disable, session revocation), but all of these playbooks still show 0 executions. Activating this would eliminate manual account creation and deactivation steps across IT and HR.

Endpoint isolation capability exists but has not been needed. The 14-playbook EDR containment toolkit (with MFA gating, Slack confirmation, and multi-vector isolation) represents a mature IR capability. With 0 executions, it either reflects a low-compromise environment or a workflow not yet integrated into the SOC's incident response runbook. Wiring it into the SOAR response router for lateral movement and ATO cases would automate containment that currently requires manual CrowdStrike console actions.

Agentic user risk assessment is growing but still underused relative to alert volume. The Blink AI Agent ("Risky Ricky") now appears in three playbooks (two Help Desk lockout assessments, Determine User risk) totaling 4 production executions. With 2,390 LogRhythm events and 372 ATO responses running through the platform, adding AI-assisted risk scoring to the ATO response path would significantly improve triage quality at scale.

Integration Ecosystem