Forvis — Customer Success Report

1. EDR Alert Triage, Enrichment & Containment

Category: SOC — EDR containment & response, Alert enrichment / IOC lookup, Case mgmt & SOAR

Description: A full-stack EDR alert pipeline spanning CrowdStrike and Microsoft Defender for Endpoints. Each alert is ingested, enriched with device, user, and IOC context from Intune, Entra ID, CrowdStrike, and Splunk, then routed through an analyst-gated approval form before automated response actions (dismiss, isolate, AV scan, or auto-investigate) are executed. Device isolation requests from Azure runbooks flow through the same containment engine.

Business Problem: SOC analysts were manually triaging alerts across two EDR platforms, correlating device and user context without tooling, and executing response actions without a structured approval workflow — leading to inconsistent triage quality and undocumented response decisions.

Integrations: CrowdStrike, Microsoft Defender for Endpoints, Microsoft Intune, Microsoft Entra ID, Splunk, SendGrid, Blink Tables

2. Identity Threat Monitoring & Response

Category: SOC — Identity threat response

Description: Entra ID is polled every 5 minutes for risky user detections. When a risky user is identified, an analyst approval workflow is triggered — delivering enriched sign-in context and IP geolocation data via a web form and email notification. Upon analyst confirmation, automated remediation actions are executed with a full audit record written back to the case table.

Business Problem: Risky user detections in Microsoft Entra ID required manual analyst review with no structured triage or remediation workflow, creating response delays and inconsistent handling across analysts.

Integrations: Microsoft Entra ID, SendGrid, Blink Web Forms, Blink Tables

3. DLP Exception Lifecycle Management

Category: GRC — DLP triage & exposure resp

Description: The full lifecycle of DLP exclusions is automated — from ingesting exception requests via EasyVista webhooks, validating destination TLS certificates, provisioning users or hosts into exclusion groups, tracking expiry dates in a Blink table, to automatically revoking exceptions when they expire. A scheduled daily cleanup enforces timely removal of untracked and expired exclusions, and a USB exception workflow handles device-based bypass requests.

Business Problem: DLP exception management was manual and error-prone. There was no automated mechanism to track expiry, enforce timely revocation, or audit active exclusions — creating both compliance exposure and operational overhead for the security team.

Integrations: EasyVista (webhook), Delinea, Blink Tables, PowerShell, SendGrid

4. Stale Device Lifecycle Automation

Category: IAM — Access review & group mgmt, Identity sync & directory mgmt

Description: Active Directory is queried via SSH and WinRM to identify computer objects that have not authenticated within defined thresholds. Results are cross-referenced against Splunk authentication logs and a curated exclusion list to eliminate false positives. Devices inactive for 90+ days are automatically disabled; devices inactive for 120+ days are deleted. Each cycle generates an HTML summary report delivered via email.

Business Problem: Stale and unmanaged device objects in Active Directory expanded the attack surface and complicated compliance audits. Manual cleanup was infrequent and inconsistent, leaving disabled or forgotten endpoints active in the directory.

Integrations: SSH (Active Directory), WinRM, Splunk, SendGrid

5. Password & Credential Management

Category: IAM — Password & credential lifecycle, Privileged account mgmt, Identity lifecycle automation

Description: User password lifecycle is managed across multiple pathways: automated provisioning triggered by the UserCube IGA platform via webhook, on-demand force-reset with end-user notification via Entra ID, and scheduled cleanup of temporary onboarding passwords in Delinea. A separate restoration workflow handles re-enabling terminated employees through a manager-approval email gate.

Business Problem: Password provisioning during onboarding, forced resets for compromised accounts, and cleanup of privileged temporary credentials all required manual IT intervention across Entra ID, Active Directory, and Delinea — creating delays and credential hygiene gaps.

Integrations: Microsoft Entra ID, Delinea, UserCube (webhook), SendGrid, SSH/WinRM, Blink Tables, Microsoft SQL Server, Splunk

6. Server Vulnerability & Asset Lifecycle

Category: Vulnerability Mgmt — Vuln scan lifecycle automation, Vuln scanning ingest & report

Description: Tenable vulnerability scanning is integrated with EasyVista IT service management. Server onboarding tickets automatically trigger a targeted Tenable scan; server offboarding tickets remove the asset from Tenable inventory. A web form portal enables system owners to submit targeted plugin-based vulnerability searches without requiring Tenable access.

Business Problem: New servers were not consistently scanned upon deployment, and decommissioned servers remained in Tenable scan targets, producing noisy and inaccurate reports. Asset lifecycle was managed manually across ITSM and vulnerability management platforms with no automation bridge.

Integrations: Tenable, EasyVista (webhook), Blink Web Forms, Blink Tables

7. Agentic SOC Toolset

Category: SOC — Agentic SOC, Alert enrichment / IOC lookup

Description: A library of modular "Ability" workflows designed for use by AI-driven SOC agents. Each ability is a discrete, input-driven action — querying Entra ID user context, executing Defender KQL advanced hunting queries, retrieving CrowdStrike host and alert details, searching Splunk, resolving Power Platform environments, or listing recent device activity. These serve as callable tools for autonomous investigation pipelines.

Business Problem: AI-assisted SOC investigation requires standardized, reusable action interfaces across security tools. Without structured abilities, agents cannot reliably retrieve and act on data from disparate platforms, limiting the effectiveness of autonomous triage.

Integrations: Microsoft Entra ID, Microsoft Defender for Endpoints, CrowdStrike, Splunk, Microsoft Power Platform

8. Phishing Alert Triage & Response

Category: SOC — Phishing detection & response

Description: A scheduled driver polls for new phishing submissions every 15 minutes and orchestrates the full triage lifecycle — logging incoming reports to tracking tables, extracting and linking related threat IDs for cross-case correlation, and dispatching analyst notifications or web forms for review and response.

Business Problem: Phishing reports were not centrally logged or correlated with related threat indicators, and there was no structured, low-latency mechanism to notify analysts or end users as new phishing submissions arrived.

Integrations: Blink Tables, Blink Web Forms, SendGrid

9. Power Platform Security Posture Monitoring

Category: Cloud Security — CSPM ingest & triage

Description: A daily scheduled job integrates with Wiz to assess the security posture of Microsoft Power Platform environments, extending cloud security posture management coverage to low-code/no-code application infrastructure.

Business Problem: Power Platform environments (apps, flows, connectors) lacked visibility into security posture and misconfiguration risk — an increasingly common blind spot as low-code platforms proliferate outside traditional IT governance.

Integrations: Wiz, Microsoft Power Platform

Strengths

High-volume DLP enforcement at scale. The DLP exception lifecycle is the most operationally active use case, with 35,072 automated exception removals and 371 additions over 12 months. This represents a mature, production-grade compliance automation covering the full add-track-expire-revoke lifecycle with no manual queuing required.

Analyst-gated SOC workflow architecture. Alert response is structured around an explicit human approval gate (web form + email), meaning automation handles enrichment, context aggregation, and orchestration while analysts retain decision authority. This is a defensible, audit-friendly design appropriate for a regulated financial services environment.

Dual-EDR coverage with unified pipeline. Both CrowdStrike and Microsoft Defender for Endpoints are integrated into a single alert triage pipeline, with IOC extraction and enrichment abstracted as reusable subflows. Cross-platform alert correlation happens automatically before any analyst interaction.

IAM automation breadth. Password lifecycle, stale device cleanup, user restoration, and privileged credential management are all automated across Entra ID, Active Directory, Delinea, and UserCube — covering the most common IAM failure modes in an enterprise environment.

Agentic SOC foundation in place. A structured Ability library covering CrowdStrike, Defender, Entra ID, Splunk, and Power Platform is deployed in a dedicated workspace. Initial execution counts (13 executions across 6 abilities) indicate early-stage adoption with a platform ready to scale into autonomous investigation workflows.

New phishing triage pipeline established. A 15-minute scheduled driver now logs phishing submissions to tracking tables, links related threat IDs for cross-case correlation, and dispatches analyst notifications — 1,252 combined executions across the driver and its subflows indicate immediate high-volume adoption.

Gaps

CrowdStrike alert pipeline inactive. Ingest - Crowdstrike Alert has 0 executions despite the full workflow being built with webhook trigger and alert enrichment steps. CrowdStrike-originated alerts are not flowing through Blink, leaving Microsoft Defender as the sole active EDR ingest source. This is a coverage gap given CrowdStrike is also deployed for containment.

Vulnerability management pipeline not operationalized. The Tenable integration handles server onboarding and offboarding (30 executions combined) but Server Vulnerability Submissions, Run Tenable Scan, and Rescan all have 0 executions. Vulnerability scanning, prioritization, and remediation tracking are not yet automated beyond asset registration.

Containment response actions unused. Subflow - AV Scan Host, Subflow - Auto Investigate, and Subflow - Isolate Host with Crowdstrike all have 0 executions. These response capabilities are built and integrated with CrowdStrike and Defender but are not being triggered through the alert response facilitation workflow.

DLP USB exception flow not activated. DLP USB Exception Workflow exists with a webhook trigger but has 0 executions. USB-based DLP exception requests are likely still being handled through a manual process outside of Blink.

Agentic SOC at early adoption. The Ability library has 11 workflows built but only 5 have been invoked (13 total executions). The agentic investigation pattern has not yet been scaled into continuous autonomous workflows.

Power Platform posture monitoring at early adoption. Wiz Integration for Power Platform is Forvis's first Cloud Security automation, running daily but with only 11 executions to date — early-stage compared to the mature DLP and identity pipelines.

Integration Ecosystem

Forvis's automation estate spans 16 distinct integrations: