Cato Networks — Customer Success Report

1. IT Helpdesk Ticket Enrichment

Description. When a Freshservice ticket is opened, Blink automatically classifies the request, identifies the requester's primary device across Kandji (Mac) and Intune (Windows), looks up Cato Networks SDP/Socket connection data, and posts a structured enrichment note back onto the ticket so the IT analyst has the full context without manual data-gathering.

Business problem. IT analysts spend the first minutes of every ticket pivoting between Freshservice, the MDM (Kandji/Intune), the directory, and the SD-WAN. Blink collapses that into a single enrichment note — cutting mean-time-to-first-response and reducing the back-and-forth with the requester.

Integrations. Freshservice · Kandji · Microsoft Intune · Microsoft Entra ID · Cato Networks · HiBob · Agents (LLM classifier) · Slack

2. Phishing Simulation & Awareness Training

Description. A full security-awareness scoring program: Microsoft Defender phishing-simulation results are pulled quarterly, Skilljar tutorial completions are checked every 4 hours across all 4 onboarding days, and three internal gamified-awareness apps (Base 44 — ObjectHunt, PhraseHunt, Connections) score employees in real time. A self-service Slack portal surfaces an employee's combined awareness scorecard.

Business problem. Security awareness programs typically suffer from siloed scoring across the phishing-sim platform, the LMS, and any custom training. Blink consolidates all of it into a single per-employee score, surfaced on-demand via Slack — and keeps a historical record for trend analysis.

Integrations. Microsoft Graph (Defender / Attack Simulator) · Skilljar (HTTP) · Slack · Tables · HiBob · Web Form

3. Password Expiration Lifecycle

Description. Four daily scheduled workflows (global + three regional variants — Americas, EMEA, APAC) query Microsoft Entra ID for accounts whose password is approaching expiration, then send personalized reminders via Outlook and Slack in the recipient's working hours.

Business problem. Mass-emailing 6 a.m. "your password expires soon" reminders results in service disruptions when employees miss them. Splitting the run by region ensures the alert lands during the employee's workday and dramatically cuts help-desk volume around password resets.

Integrations. Microsoft Entra ID · Microsoft Outlook · Slack · Tables · Python

4. Identity Lifecycle & Access Review

Description. Joiner-mover-leaver oversight: a daily sweep flags accounts inactive for 35+ days that are still members of the all-employees group, a monthly HR sync pulls last month's new hires from HiBob, and a directory helper resolves an employee's manager on demand.

Business problem. Stale accounts in critical groups expand the attack surface and break the principle of least privilege. Blink keeps inactive-user identification continuous instead of quarterly, and keeps HR & directory views aligned.

Integrations. Microsoft Entra ID · HiBob · Slack · Tables · Python

5. Security Alert Triage & Case Management

Description. Inbound security alerts (currently from an Elastic detection pipeline) trigger a Blink flow that enriches source IPs with AbuseIPDB, opens a Blink-native case with severity & vendor metadata, and notifies the case owner by email. Jira-driven incident workflows spin up dedicated Slack incident-response channels for higher-severity cases.

Business problem. Most SIEM detections never reach an analyst with enough context to act on them. Blink standardizes the first-pass triage — IP reputation, structured case creation, ownership routing — so alerts arrive already enriched and assigned.

Integrations. Elastic (webhook) · AbuseIPDB · Blink Case Management · Slack · Jira · Email

6. Threat Intel Auto-Triage

Description. External cyber-intel feeds push two categories of alert into Blink: domain-takedown candidates and credential-exposure events. An Azure-hosted LLM extracts the structured indicators (domains, emails) from the free-text alert body, the workflow opens a Jira ticket for action, and Slack notifies the responder.

Business problem. Cyber-intel vendors deliver alerts as unstructured text that an analyst has to parse and tabulate before any takedown or password-reset action can be taken. The LLM extraction step removes that manual parsing entirely, dropping triage time per alert from minutes to seconds.

Integrations. Azure OpenAI · Jira · Slack · Python · HTTP

7. Threat Hunting & User Investigation

Description. A weekly Microsoft Defender hunt queries DeviceEvents and DeviceFileEvents looking for USB drives that mounted in the past 7 days and then wrote files within minutes of the mount — a classic data-exfiltration / unsanctioned-storage signal. Separately, a Slack slash command lets any analyst paste a @user and immediately get a consolidated profile across Slack, Entra ID, Intune & Kandji.

Business problem. Manual user investigations require swiveling between 4–5 admin consoles. Blink turns it into a one-line Slack command. And periodic EDR hunts ensure storage-device risk doesn't accumulate silently between alert-driven workflows.

Integrations. Microsoft Defender for Endpoint · Microsoft Graph · Microsoft Entra ID · Intune · Kandji · Slack · Python

8. Workforce Physical Access Verification

Description. Genea (physical access control system) emits an event whenever a covered employee badges into the office. Blink writes the event to a tracking table and, for after-hours entries, sends the badge holder a Slack confirmation prompt — "was this you?" — converting denials into a security review.

Business problem. Badge-cloning and tailgating attacks usually go unnoticed because no one reviews after-hours physical-access events. A direct ask-the-user workflow turns every entry into a self-attesting control with zero analyst overhead.

Integrations. Genea (webhook) · Slack · Tables

9. Vendor Risk Monitoring

Description. A daily sweep of the procurement platform's vendor records (ZIP) finds vendors whose listed contacts use email addresses across multiple unrelated domains — a structural integrity signal that frequently indicates an impersonation or compromised-vendor risk.

Business problem. Vendor-master records degrade over time as contacts change, get added by ad-hoc users, or get spoofed. Continuous validation of contact-domain consistency surfaces TPRM red flags well before they show up in an invoice-fraud incident.

Integrations. ZIP · Python · HTTP

10. IT Self-Service & Operations

Description. Employee-facing self-service automations: a web form / Slack chatbot that calculates a laptop's residual price using live FX rates, an Apple Business Manager pull for serial-lookup, and a Slack-driven parking-spot reservation system. Exchange rates are cached weekly to keep the calculator resilient when the FX API is unavailable.

Business problem. Routine IT/HR requests (laptop pricing, parking) sit in a help-desk queue for hours when they could be answered in seconds. Self-service workflows cut ticket volume and improve employee experience.

Integrations. Web Form · Slack · HTTP (Exchange-rate API) · Apple Business Manager · HiBob · Tables · Global Variables

11. Cloud Security Posture

Description. A point-in-time AWS audit playbook that lists IAM accounts that do not have MFA configured on the root user — published but not yet on a regular schedule.

Business problem. Root-without-MFA is one of the highest-impact misconfigurations on AWS. Automating the check converts it from a periodic-audit finding into a continuous control.

Integrations. AWS

12. Network Infrastructure Monitoring

Description. Listens for site-level alerts from the Juniper Mist wireless platform and posts a structured summary into Slack so the network team can triage from chat.

Business problem. Mist's native alerts are noisy and email-based. Routing them through Blink lets the team filter, format, and consolidate them in Slack — the same channel they use for everything else.

Integrations. Mist (Juniper) · Slack

Strengths

• Mature self-service awareness program. Phishing-sim + LMS + three internal gamified-awareness apps all feed a single per-employee scorecard surfaced through Slack — this is well beyond what most security programs do for awareness analytics.
• Region-aware lifecycle workflows. The Pass-Expiration use case is split into Americas / EMEA / APAC variants so alerts land in working hours — a small detail that drives big reductions in help-desk volume.
• AI-assisted intel parsing. Cyber-intel auto-triage uses Azure OpenAI to extract structured indicators from unstructured alert bodies — turning what is usually 5+ minutes of analyst work into a sub-second extract.
• First-class IT-ticket enrichment. The Freshservice ticket-enrichment workflow pulls device data from both Kandji (Mac) and Intune (Windows) plus Cato Networks SDP context, and posts a structured note back to the ticket. This is one of the highest-volume workflows in the environment.
• Strong identity surface coverage. Microsoft Entra ID, HiBob, Slack, Kandji, and Intune are all wired into the same automation fabric — making one-Slack-command user investigations possible across all of them.

Gaps / Opportunities

• Cloud Security Posture is under-utilized. The single AWS IAM root-MFA check is published but never executed on a schedule. There's runway here to add scheduled CSPM-style sweeps (S3 public buckets, security-group exposure, IAM key age).
• Vulnerability Management is absent. No workflows tie scanner output (Tenable / Wiz / Qualys-style) to ticket creation or owner notification. A vuln-to-ticket pipeline would be a natural next addition.
• EDR containment & response is observational only. The USB-mount hunt detects but does not isolate / block. A "compromised host → isolate via Defender / Kandji lock" workflow would close that loop.
• Several "test" / draft workflows in production. Names like "Elastic Test", "TEST- Self service Portal", "Device Enrichment - Cursor Edition" are running with meaningful execution counts — they should be promoted to production names (no TEST / Cursor Edition suffixes) and the obsolete duplicates retired.
• Many regional / backup duplicates. There are 6+ Pass Exp Alert variants (backup-with-region, backup-no-region, copy, copy-copy, 16/02). Consolidating to the live four (master + Americas/EMEA/APAC) would reduce drift risk.

Integration ecosystem

The active automations span ~25 distinct integrations: Microsoft Entra ID, Microsoft Graph, Microsoft Defender for Endpoint, Microsoft Intune, Microsoft Outlook, Kandji, Slack, Jira, Freshservice, HiBob, Cato Networks, Genea, Elastic, AbuseIPDB, Azure OpenAI, Skilljar, ZIP, Apple Business Manager, AWS, Mist (Juniper), plus the Blink-native primitives (Tables, Web Form, Case Management, Python, HTTP, Global Variables). The Microsoft stack + Slack form the backbone of most workflows.