Code - Tenant — Customer Success Report

Totals: 5 playbooks, 3 active, 1,370 executions

1. Alert Enrichment & IOC Lookup

Description: On-demand workflows that enrich security alerts with threat intelligence and route findings to Slack for analyst review. Provides a lightweight IOC scanning capability using VirusTotal alongside a structured alert notification channel.

Business problem solved: Reduces analyst context-switching by surfacing threat intelligence and alert metadata directly in Slack, without requiring manual lookups in separate tools.

Integrations: VirusTotal, Slack

2. Case Management & SOAR

Description: Webhook-driven automation that listens for external events — including Coralogix alerts — and manages ticket lifecycle, closing tickets automatically and creating/routing new tickets into ManageEngine, removing the need for analysts to manually track case status across ITSM tools.

Business problem solved: Eliminates manual ticket hygiene — tickets are opened in ManageEngine and closed based on upstream alert/system state programmatically, keeping case queues accurate without analyst overhead.

Integrations: Custom Webhook (inbound), Python (custom logic), ManageEngine (ITSM ticketing)

3. Request Routing & Data Mapping

Description: High-volume webhook-triggered workflow that parses incoming requester data and maps it to the appropriate subsystem and site (ESSA). Runs custom Python logic to normalize and route data, serving as an operational data pipeline for internal request handling.

Business problem solved: Automates requester-to-subsystem assignment at scale, replacing a manual mapping process that would otherwise require repetitive analyst intervention for over 1,200 events per year.

Integrations: Custom Webhook (inbound), Python (custom logic)

Strengths

• High-volume operational automation: The Requester Mapping Site ESSA workflow is the clear workhorse — 1,246 executions in 12 months indicates a production-grade operational pipeline that is delivering consistent value at scale.
• Webhook-driven architecture: All three active workflows are event-triggered via custom webhooks, showing a mature integration pattern where Blink is embedded as a real-time responder to upstream system events — including Coralogix alerts — rather than a scheduled batch runner.
• Python extensibility in use: Custom Python steps indicate the team is leveraging Blink for complex data transformations beyond simple connector-to-connector automation.
• ITSM integration now active: Automation Ticketing System Internal pushes alert data directly into ManageEngine, extending Blink's ticketing footprint beyond closure into ticket creation/routing, with 122 executions in its first period of activity.

Gaps

• Alert enrichment workflows are dormant: Two IOC/alert enrichment playbooks (Virus Total Scan URL, Alert Slack Notif) have zero executions. These are potentially valuable SOC capabilities that have not been operationalized — either they were built for testing, lack a triggering upstream source, or have been superseded by another process.
• Narrow integration footprint: Active workflows rely on custom webhooks, Python, and now ManageEngine. VirusTotal and Slack integrations are configured but unused, leaving potential threat enrichment and notification value on the table.
• No IAM, cloud, or GRC coverage: The current automation portfolio is entirely within SOC case management and IT operations. There is no Blink footprint in identity lifecycle, cloud security posture, vulnerability management, or compliance workflows.
• Ticket-close automation remains narrow: Automation Ticket Close still has only 2 executions, while the newer Automation Ticketing System Internal workflow (122 executions) is driving most ticketing volume — closure automation may not yet be wired into the same high-volume alert path as ticket creation.

Integration Ecosystem