CyberShield — Customer Success Report

No executions were recorded in the last 12 months across any workflow in this environment. This indicates the automation suite is either newly deployed, operating in a staging or pre-production workspace, or the reporting window does not yet overlap with live production activity.

1. Agentic SOC — Alert Triage & Auto-Response

Description: End-to-end automated SOC pipeline that ingests alerts from multiple sources, extracts and deduplicates observables, creates or appends to existing cases, triggers enrichment, and routes each alert to the appropriate automated response flow based on threat type (malware, phishing).

Business Problem Solved: Eliminates manual alert triage and case creation; analysts only engage when automation escalates or cannot resolve automatically, dramatically reducing mean time to respond (MTTR).

Key Integrations: Blink Case Management, SentinelOne (webhook), CrowdStrike, Microsoft Outlook, Jira

2. Alert Enrichment & IOC Lookup

Description: Automated enrichment pipeline covering all major observable types — file hashes, IPs, URLs, domains, usernames, and email addresses — queried across a broad ecosystem of threat intelligence and identity platforms. A central router subflow dispatches enrichment per observable type and writes results back to the case management platform.

Business Problem Solved: Eliminates hours of manual querying across disparate tools; every observable attached to a case automatically receives context within seconds of alert ingestion, enabling faster and more consistent triage decisions.

Key Integrations: CrowdStrike, VirusTotal, URLScan, AbuseIPDB, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, Whois/bash

3. Threat Investigation Toolbox

Description: A library of on-demand analyst tools for deep-dive threat investigations. Analysts invoke these playbooks directly from within cases to retrieve threat context, run DNS queries, capture URL screenshots, check software end-of-life status, and search user activity logs.

Business Problem Solved: Provides a consistent, auditable set of investigation actions within the platform, eliminating ad-hoc tool pivoting and ensuring investigation steps are logged in the case record.

Key Integrations: URLScan, VirusTotal, CrowdStrike, Okta, bash (dig/whois), endoflife.date

4. EDR Containment & Remote Response

Description: CrowdStrike-based automated endpoint containment and remote command execution. Enables host isolation and Real-Time Response (RTR) operations against individual or batches of endpoints as part of an active incident response.

Business Problem Solved: Reduces time-to-contain for malware and insider threat incidents by automating host quarantine and forensic command execution without requiring direct CrowdStrike console access during high-pressure incidents.

Key Integrations: CrowdStrike

5. Identity Context Enrichment

Description: On-demand user profile lookups across the full enterprise identity stack — Google Workspace, Microsoft Entra ID, Okta, GitHub, and Slack. These playbooks surface employee details, risk status, and group memberships to support SOC investigations involving a user identity.

Business Problem Solved: Centralizes identity lookups so analysts have full user context within a case without pivoting to multiple identity portals, accelerating identity-related threat investigation.

Key Integrations: Google Workspace, Microsoft Entra ID, Okta, GitHub, Slack

6. Phishing & Email Analysis

Description: Automated phishing investigation pipeline triggered by new Outlook phishing reports. Performs deep EML analysis — header inspection, attachment hashing, URL risk scoring, sender domain WhoIS — and filters out KnowBe4 phishing simulation campaigns via X-PHISHTEST header detection to prevent false escalations.

Business Problem Solved: Reduces analyst time spent triaging user-reported phishing emails; simulation emails are automatically suppressed and real phishing submissions receive a full risk assessment within seconds of submission.

Key Integrations: Microsoft Outlook, KnowBe4 (simulation filtering), VirusTotal, URLScan, AbuseIPDB, Whois

7. Baseline Configuration Reporting

Description: MSSP-grade automated reporting pipeline that queries the configuration state of four major security platforms — Microsoft Sentinel, CyberArk, Proofpoint, and Varonis — and compiles a structured baseline configuration report per client. Reports are triggered via a branded web form, support a fully-agentic mode, and are delivered by email with a Microsoft Teams review step.

Business Problem Solved: Eliminates manual, time-consuming multi-tool data collection for quarterly or monthly client configuration reviews; CyberShield can deliver consistent, standardized baseline reports at scale across their managed client portfolio.

Key Integrations: Microsoft Sentinel, CyberArk, Proofpoint, Varonis, Microsoft Teams, email

8. Case Management & Observable Lifecycle

Description: Full lifecycle management of security observables and cases within the Blink SOAR platform. Covers observable relationship creation, deduplication, cross-case similarity analysis, stale case cleanup, alert template validation, and AI-assisted inquiry generation with human-in-the-loop review.

Business Problem Solved: Maintains data quality within the SOAR platform, prevents analyst fatigue from stale open cases, and enables pivot-based threat hunting by surfacing similar cases that share observables.

Key Integrations: Blink Case Management, Blink AI Agents, Microsoft Teams

9. JIT Access Management

Description: Automated just-in-time group membership assignment in Azure Active Directory with configurable expiration, triggered on demand. Confirms successful assignment before returning output to the caller.

Business Problem Solved: Reduces standing privilege by granting temporary group access without manual IT operations, supporting least-privilege access models and minimizing the window of privileged access exposure.

Key Integrations: Microsoft Entra ID / Azure Active Directory

10. MSSP Client Intake & Ticketing

Description: External-facing workflows that standardize how CyberShield's clients submit support requests, incidents, and inquiries. Includes a branded public web intake form with SaaS tool selection and priority classification, Jira-based incident ingestion, and a dedicated integration for Banner Life's Ivanti HEAT ticketing system.

Business Problem Solved: Provides a consistent, branded intake experience for CyberShield's managed clients, automatically routing incoming requests into the case management platform for SLA tracking and response.

Key Integrations: Jira, Ivanti HEAT, Blink Web Forms, Blink Case Management

11. Vulnerability Risk Reporting

Description: Generates an HTML vulnerability risk report by aggregating asset data from a Blink table and delivering it via email, providing lightweight risk posture visibility to stakeholders on demand.

Business Problem Solved: Provides regular vulnerability posture summaries without manual data extraction or report formatting effort.

Key Integrations: Blink Tables, email (Blink core)

12. Platform Utilities & Testing

Description: Administrative, testing, and example playbooks that support the development and maintenance of the automation platform. Includes alert simulations for QA testing across multiple vendors (CrowdStrike, Proofpoint, Okta), a full environment reset capability, and example asset inventory templates for CrowdStrike and Kandji.

Business Problem Solved: Enables safe, repeatable testing of the SOC pipeline without using real production alerts and provides reference implementations for common integration patterns.

Key Integrations: CrowdStrike, Kandji, Blink Case Management, email

Strengths

1. Full SOC pipeline automation. CyberShield has built a complete alert-to-response pipeline — multi-source alert ingestion (CrowdStrike, SentinelOne webhook, Jira, manual), observable extraction and deduplication, enrichment, case creation, and automated response routing — with dedicated error recovery and resilience playbooks built in.

1. Breadth of enrichment integrations. 14 distinct enrichment sources spanning file hash (VirusTotal, CrowdStrike), URL (VirusTotal, URLScan), IP (VirusTotal, AbuseIPDB, Whois), and user identity (Okta, Entra ID, Google Workspace, GitHub, Slack). This is among the most comprehensive observable enrichment stacks in customer deployments.

1. MSSP-native architecture. Multi-client configuration reporting triggered from a branded web form, client-specific ticketing integrations (Banner Life → Ivanti HEAT), a fully agentic report generator mode, and a public-facing CyberShield Request Form position the platform to deliver managed security services at scale across a varied client portfolio.

1. Phishing simulation awareness. The phishing response subflow explicitly filters KnowBe4 simulation campaigns via X-PHISHTEST header inspection, preventing simulation emails from generating real SOC workload — a sign of operational maturity.

1. Resilience-first design. Dedicated recovery playbooks (Recovery - Handle Unprocessed Alerts, Recovery - Enrich Non-Enriched Observables) ensure the pipeline self-heals from partial failures, reducing the risk of alerts being silently dropped.

1. AI-augmented inquiry handling. Generate New Inquiry invokes a Blink AI agent for automated inquiry drafting, with a Microsoft Teams interactivity step for human review — an early indicator of agentic SOC maturity.

Gaps & Opportunities

1. No recorded executions. All 76 playbooks report zero executions in the last 12 months. This strongly suggests the environment is pre-production, a staging/demo workspace, or execution data was not captured in the reporting window. Without production data it is not possible to measure automation value delivered.

1. Duplicate playbooks across workspaces. Generate_Report_Main, Report Generator, and all four Query * for Config Report playbooks exist in two separate workspaces each. This creates maintenance overhead and risk of version drift. Consolidation to a single canonical workspace is recommended.

1. No SIEM log pipeline coverage. Despite integrating with Microsoft Sentinel for configuration auditing, there are no playbooks for SIEM alert ingestion, log pipeline health monitoring, or analytics rule lifecycle management. The SIEM & log pipeline monitoring subcategory is entirely absent.

1. No cloud security or CSPM coverage. Zero playbooks address cloud posture (CSPM, cloud asset inventory, cloud configuration remediation). Given the client base includes Azure Sentinel and Entra ID customers, cloud posture automation is a natural expansion.

1. Limited IAM lifecycle automation. Only one IAM playbook (JIT access via Azure AD). No employee onboarding/offboarding, access review, or identity lifecycle workflows exist despite active integrations with Okta, Entra ID, and Google Workspace.

1. Incomplete/placeholder playbooks. Two unnamed "New Workflow" playbooks and two "EXAMPLE" prefixed playbooks remain in production workspaces, indicating in-progress development that has not been cleaned up or promoted.

1. No threat hunting or detection content. No playbooks address proactive threat hunting, IOC feed ingestion, or detection rule lifecycle management — all opportunities to expand the SOC automation surface.

Integration Ecosystem