NIQ — Customer Success Report

Use Case 1 — SOC Case Management & Alert Triage

Description: End-to-end automated SOC pipeline that ingests security alerts, extracts and deduplicates observables, runs enrichment, and routes cases through approval workflows. Enables a lean SOC team to handle high alert volumes with consistent, repeatable triage logic.

Business Problem Solved: Security analysts spend the majority of their time on repetitive alert processing tasks. This use case removes that burden by automatically normalizing alerts, extracting indicators, deduplicating cases, running enrichment in parallel, and escalating only when human judgment is genuinely required.

Integrations: Blink Case Management, Microsoft Teams, Blink API

Use Case 2 — IOC Enrichment & Threat Hunting

Description: Automated enrichment and hunting pipeline for Indicators of Compromise (IOCs). When an observable is identified, Blink routes it to the appropriate enrichment sources and hunting tools, then triggers automated response if a malicious verdict is reached. Covers IPs, domains, hashes, CVEs, and software packages across multiple security products.

Business Problem Solved: Manual IOC lookup and hunting across siloed tools (Defender XDR, SentinelOne, AlienVault OTX, Wiz, Cycode) is slow and inconsistent. This use case automates the full investigation chain from detection to containment decision.

Integrations: Microsoft Defender XDR, SentinelOne, AlienVault OTX, Wiz, Cycode, Zscaler ZIA, Blink Case Management

Use Case 3 — Threat Intelligence Ingestion & Curation

Description: Automated ingestion of threat intelligence from multiple sources including CISA RSS feeds, Rapid7 advisories, Wiz GraphQL queries, shared mailbox scanning, and manual webpage ingestion. An AI agent normalizes and structures the raw intelligence into actionable case management records. Weekly reporting delivers consolidated threat landscape summaries to the security team.

Business Problem Solved: Monitoring multiple disparate threat intel feeds manually is time-intensive and inconsistent. This use case ensures no advisory is missed, normalizes heterogeneous formats, and surfaces actionable intelligence automatically to the CTSO team.

Integrations: CISA RSS, Rapid7 RSS, Wiz, Microsoft Outlook, SailPoint

Use Case 4 — Vulnerability Management Data Lake Pipeline

Description: Enterprise-scale vulnerability data ingestion pipeline that pulls findings from Microsoft Defender, Rapid7 InsightVM, Wiz, and ServiceNow CMDB into an Azure Data Lake Storage (ADLS) / Synapse environment. Supports daily ingestion, cursor-based pagination, data normalization to OCSF schema, KEV/EPSS/NVD dimension tables, and automated phantom purge for stale records. Enables a single source of truth for the VM program across multiple business units and scanner sources.

Business Problem Solved: NIQ runs Defender, Rapid7, and Wiz across separate business units (NIQ and GFK). Without automation, reconciling vulnerability data across scanners and feeding it into a datalake for analytics would require substantial manual engineering work. This pipeline automates the entire ingestion-normalization-enrichment-analytics chain.

Integrations: Microsoft Defender for Endpoints, Rapid7 InsightVM Cloud, Wiz, ServiceNow CMDB, Azure Data Lake Storage / Azure Synapse, CISA KEV, EPSS, NVD

Use Case 5 — Vulnerability Lifecycle: Prioritization, Ticketing & Reporting

Description: Downstream processing of vulnerability data for SLA evaluation, cross-source asset correlation, remediation candidate generation, Jira ticket assignment, and executive reporting. Includes AI-powered analyst agents for natural language querying of the vulnerability datalake and on-demand CVE search capability.

Business Problem Solved: After ingestion, vulnerability data must be correlated across multiple scanners and business units, enriched with SLA context, prioritized by CVSS/EPSS/KEV, and routed to the right ticket owners. This use case automates that entire chain, ensuring no critical finding sits unowned.

Integrations: Azure Synapse, Jira, Wiz, Rapid7 InsightVM, Microsoft Defender, Blink Case Management, AI Agents

Use Case 6 — Employee Offboarding & IAM Response

Description: Automated offboarding pipeline triggered by SailPoint termination events. Blink processes each departing employee by revoking user sessions, resetting passwords, revoking MFA methods, wiping or unenrolling devices from Intune, and closing the associated case. A scheduled workflow handles edge cases and batches unresolved offboarding events to a downstream ITSM system (D3).

Business Problem Solved: Employee offboarding is a high-risk, time-sensitive IAM process. Missing a device wipe or leaving sessions active post-termination creates significant data leakage exposure. This use case automates the full sequence and provides audit trails for compliance.

Integrations: SailPoint, Microsoft Entra ID, Microsoft Intune, SentinelOne, Blink Case Management

Use Case 7 — Identity Threat Response (EDR Containment)

Description: Automated response actions for compromised identities and devices. Covers IOC blocking across Microsoft Defender for Endpoint and SentinelOne, user session revocation and password reset, device isolation and scan initiation, and URL blocking via Zscaler ZIA. All actions are gated through an approval workflow before execution.

Business Problem Solved: When a malicious observable is confirmed, response execution latency is critical. Manual containment across multiple tools (MDE, S1, Zscaler) introduces unacceptable delay. This use case automates the full response chain with human-in-the-loop approval where required.

Integrations: Microsoft Defender for Endpoint, SentinelOne, Microsoft Entra ID, Zscaler ZIA

Use Case 8 — Cloud Asset Coverage & Inventory

Description: Multi-source asset inventory aggregation pipeline that collects device and software inventory from Microsoft Defender, SentinelOne, Wiz, Rapid7, Entra ID, Intune, Zscaler, Jamf, and ServiceNow. Assets are correlated across sources and written to a shared inventory table for vulnerability correlation and coverage gap analysis.

Business Problem Solved: Without a unified asset inventory, vulnerability remediation cannot be accurately scoped. This use case continuously syncs asset records from all deployed security tools and identifies coverage gaps where EDR is missing.

Integrations: Microsoft Defender for Endpoints, SentinelOne, Wiz, Rapid7, Microsoft Entra ID, Intune, Zscaler, Jamf, ServiceNow, Spektion, Microsoft Active Directory

Use Case 9 — SaaS Application Governance

Description: Scheduled governance automation that queries Zscaler ZIA for third-party SaaS applications present in the environment, generates compliance views, and feeds findings into a reporting pipeline. Surfaces shadow IT and unauthorized application usage.

Business Problem Solved: Unmanaged SaaS applications represent a data leakage and compliance risk. This use case automates the detection and cataloging of all SaaS applications traversing the network perimeter.

Integrations: Zscaler ZIA, Microsoft Outlook

Use Case 10 — GRC & Security Reporting

Description: Automated security metrics and executive reporting workflows including weekly threat intelligence reports and Blink automation reporting. Provides consistent, timely security status updates to stakeholders without manual report assembly.

Business Problem Solved: Preparing security metrics reports manually is error-prone and time-consuming. Automation ensures reports are generated on schedule with up-to-date data from live case management and vulnerability systems.

Integrations: Blink Case Management, Email

Use Case 11 — AI Agent Governance & Inventory

Description: A new automation program that discovers, correlates, and monitors AI agents deployed across the enterprise — pulling agent telemetry from Microsoft Defender (Security Copilot / M365 agent activity via Microsoft Graph) and Wiz (cloud-deployed AI agents), reconciling both sources into a unified AI-agent inventory with identity links, and computing governance/risk metrics (exposure, connected hubs, tool/MCP counts, shared-connection risk). Dashboards surface capability analytics and priority governance gaps.

Business Problem Solved: AI agents (Copilot extensions, cloud-hosted agents, MCP-connected tools) are proliferating faster than security teams can track them, creating an ungoverned identity and data-access surface. This use case builds the asset inventory and risk-scoring layer needed to bring AI agents under the same governance rigor as traditional endpoints and cloud resources.

Integrations: Microsoft Defender, Microsoft Graph (M365), Wiz, Blink Case Management

Strengths

Deep, production-grade Vulnerability Management program. NIQ has built one of the most sophisticated VM automation programs in the Blink customer base. The ADLS pipeline ingests vulnerabilities from three scanner families (Defender, Rapid7, Wiz) across multiple business unit instances (NIQ + GFK), normalizes to OCSF, enriches with KEV/EPSS/NVD context, correlates cross-source, and drives Jira remediation ticket creation — all automated. The daily cadence of KEV, EPSS, and NVD dimension builds (38–40 executions each) and Defender/R7/Wiz ingestion runs (127–1,348 executions) demonstrates genuine production reliance.

High-volume SOC automation is operational and running. The Case Orchestrator and Observable Orchestrator together processed nearly 7,700 items in the past 12 months. The enrichment chain (Observable Router → per-tool Hunt subflows → Update Observable Findings at 4,154 executions) is clearly handling real alert volume, not just testing.

Agentic security capabilities are deployed. NIQ has production AI agents for three distinct functions: TI Analyst Agent (threat intelligence interrogation), VM Analyst Agent (natural language vulnerability datalake queries), and a VM Operator Agent with full pipeline tooling. This positions NIQ ahead of most customers in deploying agentic security workflows.

Breadth of integration ecosystem. NIQ's automation spans: Microsoft Defender XDR, SentinelOne, Wiz, Rapid7 InsightVM, Microsoft Entra ID, Microsoft Intune, Zscaler ZIA/SSPM, SailPoint, AlienVault OTX, Cycode, ServiceNow, Jira, Azure Synapse / ADLS, CISA KEV, EPSS, NVD — a mature, enterprise-scale integration footprint.

Cross-business-unit coverage. The VM pipeline explicitly handles both the NIQ and GFK entities with separate scanner connections, reflecting a post-merger integration use case where automation bridges organizational boundaries.

New: AI Agent Governance program stood up. NIQ has launched a dedicated workspace and pipeline (Use Case 11) to inventory and risk-score AI agents across Microsoft Defender/M365 and Wiz — reconciling both sources into a unified inventory, computing exposure and shared-connection risk metrics, and publishing governance dashboards. The AI Agent Chunk Writer alone processed 375 records in its first period, indicating active, ongoing discovery rather than a one-time pilot. This positions NIQ ahead of the curve on a fast-emerging AI-agent attack surface.

New: second asset ingestion pipeline stood up with EOL-OS and metrics capabilities. A new workspace mirrors the core asset-inventory subflows (shared inventory writer, ingestion health writer, cleanup, coverage reporting) and adds two new capabilities not previously present: end-of-life OS detection and asset metrics computation. It also extends source coverage with Spektion and Microsoft Active Directory connectors, and has since added parallel Get-Assets connectors for SentinelOne, Zscaler, Microsoft Entra AD, ServiceNow, Microsoft Defender for Endpoint, Rapid7 InsightVM, Intune, Jamf, and Tanium — effectively rebuilding the full source breadth of the original pipeline within the new architecture. The inventory writer alone processed 940 records, indicating active parallel rollout rather than a dormant fork. The pipeline has since gained its own user-ingestion orchestrator, ASM Analyst Agent abilities, device/host lookup subflows, and error-notification handling — mirroring the original pipeline's full operator toolset, though these newest additions have not yet accrued executions.

VM scanner coverage expanded significantly. Beyond Defender, Rapid7, and Wiz, NIQ has added Spektion, Tanium, and SecurityScorecard as new vulnerability/software-risk data sources, each with its own ingestion, writer, and hunting playbooks already producing meaningful volume (Spektion and Tanium software hunts each running in the 200+ execution range, on par with the original three scanners).

Gaps and Opportunities

Response playbooks built but not yet executing. Several high-value response actions have 0 executions: IOC blocking (Defender for Endpoint, SentinelOne, Zscaler), device isolation (Defender, SentinelOne), and user credential reset (Entra). The approval workflow infrastructure exists and is running (693 IOC response trigger events fired). The gap suggests response is still requiring manual confirmation at a high rate, or the blocking/isolation capabilities are staged for broader rollout. Activating automated response for confirmed malicious IOCs would significantly reduce dwell time.

WF0–WF7 table-based VM pipeline has 0 executions. The older workspace (06f7470e) containing WF0–WF8 workflows shows zero execution across all workflows. All active VM pipeline execution is occurring in the newer workspace (b76c3ccc). The older workspace appears to be a superseded iteration — these playbooks could be archived to reduce maintenance overhead.

User Response Actions workflow has 0 executions. The Response - User Response Actions event-based workflow (which responds to compromised user table records) fired 0 times, while the Device Response Actions workflow fired 14. This asymmetry suggests the user response workflow may not be connected to the active case management tables.

Software CVE hunt executions appear pooled across wrapper playbooks. The Blink VM integration wrapper playbooks (Hunt - Software - SentinelOne - Blink Vulnerability Management, Hunt - Software - Wiz - Blink Vulnerability Management, Hunt - Software - Cycode - Blink Vulnerability Management) each show 1,044 executions — likely the same hunt batch running across all three sources in parallel. The underlying direct hunt playbooks (Hunt - Software - SentinelOne, Hunt - Software - Wiz at 1,044 and Hunt - Software - Cycode at 1,109) show consistent counts, confirming a live software hunt program.

ASM workspace (2a845363) has no active playbooks. The Attack Surface Management workspace contains several drafted workflows (Coverage Gap - Alert and Ticket, Ingestion Health Monitor, ASM Agent) with 0 executions. This appears to be an emerging capability being developed rather than production automation.

Integration Ecosystem Summary

Use Case 1 — SOC Case Management & Alert Triage

Description: End-to-end automated SOC pipeline that ingests security alerts, extracts and deduplicates observables, runs enrichment, and routes cases through approval workflows. Enables a lean SOC team to handle high alert volumes with consistent, repeatable triage logic.

Business Problem Solved: Security analysts spend the majority of their time on repetitive alert processing tasks. This use case removes that burden by automatically normalizing alerts, extracting indicators, deduplicating cases, running enrichment in parallel, and escalating only when human judgment is genuinely required.

Integrations: Blink Case Management, Microsoft Teams, Blink API

Use Case 2 — IOC Enrichment & Threat Hunting

Description: Automated enrichment and hunting pipeline for Indicators of Compromise (IOCs). When an observable is identified, Blink routes it to the appropriate enrichment sources and hunting tools, then triggers automated response if a malicious verdict is reached. Covers IPs, domains, hashes, CVEs, and software packages across multiple security products.

Business Problem Solved: Manual IOC lookup and hunting across siloed tools (Defender XDR, SentinelOne, AlienVault OTX, Wiz, Cycode) is slow and inconsistent. This use case automates the full investigation chain from detection to containment decision.

Integrations: Microsoft Defender XDR, SentinelOne, AlienVault OTX, Wiz, Cycode, Zscaler ZIA, Blink Case Management

Use Case 3 — Threat Intelligence Ingestion & Curation

Description: Automated ingestion of threat intelligence from multiple sources including CISA RSS feeds, Rapid7 advisories, Wiz GraphQL queries, shared mailbox scanning, and manual webpage ingestion. An AI agent normalizes and structures the raw intelligence into actionable case management records. Weekly reporting delivers consolidated threat landscape summaries to the security team.

Business Problem Solved: Monitoring multiple disparate threat intel feeds manually is time-intensive and inconsistent. This use case ensures no advisory is missed, normalizes heterogeneous formats, and surfaces actionable intelligence automatically to the CTSO team.

Integrations: CISA RSS, Rapid7 RSS, Wiz, Microsoft Outlook, SailPoint

Use Case 4 — Vulnerability Management Data Lake Pipeline

Description: Enterprise-scale vulnerability data ingestion pipeline that pulls findings from Microsoft Defender, Rapid7 InsightVM, Wiz, and ServiceNow CMDB into an Azure Data Lake Storage (ADLS) / Synapse environment. Supports daily ingestion, cursor-based pagination, data normalization to OCSF schema, KEV/EPSS/NVD dimension tables, and automated phantom purge for stale records. Enables a single source of truth for the VM program across multiple business units and scanner sources.

Business Problem Solved: NIQ runs Defender, Rapid7, and Wiz across separate business units (NIQ and GFK). Without automation, reconciling vulnerability data across scanners and feeding it into a datalake for analytics would require substantial manual engineering work. This pipeline automates the entire ingestion-normalization-enrichment-analytics chain.

Integrations: Microsoft Defender for Endpoints, Rapid7 InsightVM Cloud, Wiz, ServiceNow CMDB, Azure Data Lake Storage / Azure Synapse, CISA KEV, EPSS, NVD

Use Case 5 — Vulnerability Lifecycle: Prioritization, Ticketing & Reporting

Description: Downstream processing of vulnerability data for SLA evaluation, cross-source asset correlation, remediation candidate generation, Jira ticket assignment, and executive reporting. Includes AI-powered analyst agents for natural language querying of the vulnerability datalake and on-demand CVE search capability.

Business Problem Solved: After ingestion, vulnerability data must be correlated across multiple scanners and business units, enriched with SLA context, prioritized by CVSS/EPSS/KEV, and routed to the right ticket owners. This use case automates that entire chain, ensuring no critical finding sits unowned.

Integrations: Azure Synapse, Jira, Wiz, Rapid7 InsightVM, Microsoft Defender, Blink Case Management, AI Agents

Use Case 6 — Employee Offboarding & IAM Response

Description: Automated offboarding pipeline triggered by SailPoint termination events. Blink processes each departing employee by revoking user sessions, resetting passwords, revoking MFA methods, wiping or unenrolling devices from Intune, and closing the associated case. A scheduled workflow handles edge cases and batches unresolved offboarding events to a downstream ITSM system (D3).

Business Problem Solved: Employee offboarding is a high-risk, time-sensitive IAM process. Missing a device wipe or leaving sessions active post-termination creates significant data leakage exposure. This use case automates the full sequence and provides audit trails for compliance.

Integrations: SailPoint, Microsoft Entra ID, Microsoft Intune, SentinelOne, Blink Case Management

Use Case 7 — Identity Threat Response (EDR Containment)

Description: Automated response actions for compromised identities and devices. Covers IOC blocking across Microsoft Defender for Endpoint and SentinelOne, user session revocation and password reset, device isolation and scan initiation, and URL blocking via Zscaler ZIA. All actions are gated through an approval workflow before execution.

Business Problem Solved: When a malicious observable is confirmed, response execution latency is critical. Manual containment across multiple tools (MDE, S1, Zscaler) introduces unacceptable delay. This use case automates the full response chain with human-in-the-loop approval where required.

Integrations: Microsoft Defender for Endpoint, SentinelOne, Microsoft Entra ID, Zscaler ZIA

Use Case 8 — Cloud Asset Coverage & Inventory

Description: Multi-source asset inventory aggregation pipeline that collects device and software inventory from Microsoft Defender, SentinelOne, Wiz, Rapid7, Entra ID, Intune, Zscaler, Jamf, and ServiceNow. Assets are correlated across sources and written to a shared inventory table for vulnerability correlation and coverage gap analysis.

Business Problem Solved: Without a unified asset inventory, vulnerability remediation cannot be accurately scoped. This use case continuously syncs asset records from all deployed security tools and identifies coverage gaps where EDR is missing.

Integrations: Microsoft Defender for Endpoints, SentinelOne, Wiz, Rapid7, Microsoft Entra ID, Intune, Zscaler, Jamf, ServiceNow, Spektion, Microsoft Active Directory

Use Case 9 — SaaS Application Governance

Description: Scheduled governance automation that queries Zscaler ZIA for third-party SaaS applications present in the environment, generates compliance views, and feeds findings into a reporting pipeline. Surfaces shadow IT and unauthorized application usage.

Business Problem Solved: Unmanaged SaaS applications represent a data leakage and compliance risk. This use case automates the detection and cataloging of all SaaS applications traversing the network perimeter.

Integrations: Zscaler ZIA, Microsoft Outlook

Use Case 10 — GRC & Security Reporting

Description: Automated security metrics and executive reporting workflows including weekly threat intelligence reports and Blink automation reporting. Provides consistent, timely security status updates to stakeholders without manual report assembly.

Business Problem Solved: Preparing security metrics reports manually is error-prone and time-consuming. Automation ensures reports are generated on schedule with up-to-date data from live case management and vulnerability systems.

Integrations: Blink Case Management, Email

Use Case 11 — AI Agent Governance & Inventory

Description: A new automation program that discovers, correlates, and monitors AI agents deployed across the enterprise — pulling agent telemetry from Microsoft Defender (Security Copilot / M365 agent activity via Microsoft Graph) and Wiz (cloud-deployed AI agents), reconciling both sources into a unified AI-agent inventory with identity links, and computing governance/risk metrics (exposure, connected hubs, tool/MCP counts, shared-connection risk). Dashboards surface capability analytics and priority governance gaps.

Business Problem Solved: AI agents (Copilot extensions, cloud-hosted agents, MCP-connected tools) are proliferating faster than security teams can track them, creating an ungoverned identity and data-access surface. This use case builds the asset inventory and risk-scoring layer needed to bring AI agents under the same governance rigor as traditional endpoints and cloud resources.

Integrations: Microsoft Defender, Microsoft Graph (M365), Wiz, Blink Case Management

Strengths

Deep, production-grade Vulnerability Management program. NIQ has built one of the most sophisticated VM automation programs in the Blink customer base. The ADLS pipeline ingests vulnerabilities from three scanner families (Defender, Rapid7, Wiz) across multiple business unit instances (NIQ + GFK), normalizes to OCSF, enriches with KEV/EPSS/NVD context, correlates cross-source, and drives Jira remediation ticket creation — all automated. The daily cadence of KEV, EPSS, and NVD dimension builds (38–40 executions each) and Defender/R7/Wiz ingestion runs (127–1,348 executions) demonstrates genuine production reliance.

High-volume SOC automation is operational and running. The Case Orchestrator and Observable Orchestrator together processed nearly 7,700 items in the past 12 months. The enrichment chain (Observable Router → per-tool Hunt subflows → Update Observable Findings at 4,154 executions) is clearly handling real alert volume, not just testing.

Agentic security capabilities are deployed. NIQ has production AI agents for three distinct functions: TI Analyst Agent (threat intelligence interrogation), VM Analyst Agent (natural language vulnerability datalake queries), and a VM Operator Agent with full pipeline tooling. This positions NIQ ahead of most customers in deploying agentic security workflows.

Breadth of integration ecosystem. NIQ's automation spans: Microsoft Defender XDR, SentinelOne, Wiz, Rapid7 InsightVM, Microsoft Entra ID, Microsoft Intune, Zscaler ZIA/SSPM, SailPoint, AlienVault OTX, Cycode, ServiceNow, Jira, Azure Synapse / ADLS, CISA KEV, EPSS, NVD — a mature, enterprise-scale integration footprint.

Cross-business-unit coverage. The VM pipeline explicitly handles both the NIQ and GFK entities with separate scanner connections, reflecting a post-merger integration use case where automation bridges organizational boundaries.

New: AI Agent Governance program stood up. NIQ has launched a dedicated workspace and pipeline (Use Case 11) to inventory and risk-score AI agents across Microsoft Defender/M365 and Wiz — reconciling both sources into a unified inventory, computing exposure and shared-connection risk metrics, and publishing governance dashboards. The AI Agent Chunk Writer alone processed 375 records in its first period, indicating active, ongoing discovery rather than a one-time pilot. This positions NIQ ahead of the curve on a fast-emerging AI-agent attack surface.

New: second asset ingestion pipeline stood up with EOL-OS and metrics capabilities. A new workspace mirrors the core asset-inventory subflows (shared inventory writer, ingestion health writer, cleanup, coverage reporting) and adds two new capabilities not previously present: end-of-life OS detection and asset metrics computation. It also extends source coverage with Spektion and Microsoft Active Directory connectors, and has since added parallel Get-Assets connectors for SentinelOne, Zscaler, Microsoft Entra AD, ServiceNow, Microsoft Defender for Endpoint, Rapid7 InsightVM, Intune, Jamf, and Tanium — effectively rebuilding the full source breadth of the original pipeline within the new architecture. The inventory writer alone processed 940 records, indicating active parallel rollout rather than a dormant fork. The pipeline has since gained its own user-ingestion orchestrator, ASM Analyst Agent abilities, device/host lookup subflows, and error-notification handling — mirroring the original pipeline's full operator toolset, though these newest additions have not yet accrued executions.

VM scanner coverage expanded significantly. Beyond Defender, Rapid7, and Wiz, NIQ has added Spektion, Tanium, and SecurityScorecard as new vulnerability/software-risk data sources, each with its own ingestion, writer, and hunting playbooks already producing meaningful volume (Spektion and Tanium software hunts each running in the 200+ execution range, on par with the original three scanners).

Gaps and Opportunities

Response playbooks built but not yet executing. Several high-value response actions have 0 executions: IOC blocking (Defender for Endpoint, SentinelOne, Zscaler), device isolation (Defender, SentinelOne), and user credential reset (Entra). The approval workflow infrastructure exists and is running (693 IOC response trigger events fired). The gap suggests response is still requiring manual confirmation at a high rate, or the blocking/isolation capabilities are staged for broader rollout. Activating automated response for confirmed malicious IOCs would significantly reduce dwell time.

WF0–WF7 table-based VM pipeline has 0 executions. The older workspace (06f7470e) containing WF0–WF8 workflows shows zero execution across all workflows. All active VM pipeline execution is occurring in the newer workspace (b76c3ccc). The older workspace appears to be a superseded iteration — these playbooks could be archived to reduce maintenance overhead.

User Response Actions workflow has 0 executions. The Response - User Response Actions event-based workflow (which responds to compromised user table records) fired 0 times, while the Device Response Actions workflow fired 14. This asymmetry suggests the user response workflow may not be connected to the active case management tables.

Software CVE hunt executions appear pooled across wrapper playbooks. The Blink VM integration wrapper playbooks (Hunt - Software - SentinelOne - Blink Vulnerability Management, Hunt - Software - Wiz - Blink Vulnerability Management, Hunt - Software - Cycode - Blink Vulnerability Management) each show 1,044 executions — likely the same hunt batch running across all three sources in parallel. The underlying direct hunt playbooks (Hunt - Software - SentinelOne, Hunt - Software - Wiz at 1,044 and Hunt - Software - Cycode at 1,109) show consistent counts, confirming a live software hunt program.

ASM workspace (2a845363) has no active playbooks. The Attack Surface Management workspace contains several drafted workflows (Coverage Gap - Alert and Ticket, Ingestion Health Monitor, ASM Agent) with 0 executions. This appears to be an emerging capability being developed rather than production automation.

Integration Ecosystem Summary