hub — Customer Success Report

1. Agentic SOC — Automated Alert Triage & Response

Description: End-to-end alert processing pipeline that ingests raw security alerts, extracts and deduplicates observables, creates or links Blink cases, enriches indicators, executes type-specific response logic (phishing, malware, impossible travel, Nigeria logins), and auto-builds a structured case overview for the analyst. This is the primary SOC automation backbone, running continuously.

Business problem: High-volume alert queues overwhelm SOC analysts with repetitive triage, enrichment, and initial response steps. This automation eliminates that manual burden by handling every incoming alert from ingestion through initial response without analyst involvement.

Category: SOC | Subcategories: Agentic SOC, Case mgmt & SOAR, Alert enrichment / IOC lookup

Integrations: Blink Case Management, Microsoft Entra ID (sign-in logs), ServiceNow, Microsoft Excel (travel tracker)

2. Phishing Detection & Response

Description: Monitors a dedicated phishing submission mailbox, retrieves and parses full email content (EML), analyzes headers, URLs, attachments, and sender domain reputation, creates a case, and sends analyst notifications with enriched context. Supports both automated ingestion via Outlook polling and analyst-triggered workflows for manual phishing reports.

Business problem: Phishing reports from employees arrive continuously and require time-consuming manual analysis of email headers, link reputation, and attachment hashes. This automation converts every user submission into an analyzed, enriched, and triaged security case within minutes.

Category: SOC | Subcategories: Phishing detection & response, Alert enrichment / IOC lookup

Integrations: Microsoft Outlook / Exchange Online, Mimecast, VirusTotal, URLScan, Any.run, AbuseIPDB, Blink Case Management

3. Identity Threat Response

Description: Automated containment workflow triggered when a user account is identified as compromised or suspicious. Resets the Entra ID password, revokes all active sessions, resets MFA credentials, gathers sign-in and audit logs, and notifies the user's manager. Supports both automated case-driven invocation and on-demand analyst-triggered execution.

Business problem: Responding to compromised account alerts requires coordinated actions across identity systems that are error-prone and slow when performed manually. This automation ensures consistent, rapid containment — password reset, session revocation, and MFA reset — within seconds of detection.

Category: SOC | Subcategories: Identity threat response, Alert enrichment / IOC lookup

Integrations: Microsoft Entra ID (Active Directory), Microsoft Outlook / Exchange Online, Blink Case Management

4. Case Mgmt & SOAR — CSS Ticketing Integration

Description: Bidirectional integration between the Blink SOAR case management platform and an external CSS (Customer Support/Security) ticketing system. Ingests new CSS tickets as Blink alerts, maps status changes in both directions, syncs comments between platforms, and sends closure events back to CSS when Blink resolves a case. Maintains a tracking table of unprocessed case data.

Business problem: Security incidents managed in Blink must stay in sync with the enterprise ticketing system used by operations and management. Without automation, analysts manually copy updates between systems, creating lag and inconsistency. This integration eliminates dual-entry and ensures real-time bidirectional status and comment sync.

Category: SOC | Subcategories: Case mgmt & SOAR, Agentic SOC

Integrations: Blink Case Management, Custom webhook (CSS ticketing), Microsoft Exchange Online (email notifications)

5. EDR Containment & Response

Description: On-demand and case-driven EDR response actions against SentinelOne-managed endpoints. Covers the full containment cycle: initiate a scan, isolate an endpoint, block a file hash, cancel isolation, and search for endpoints associated with a compromised user account.

Business problem: EDR containment steps must be executed quickly and repeatably when a threat is confirmed on an endpoint. Manual execution via EDR console is slow and introduces human error. These playbooks allow the SOC to trigger endpoint isolation, scanning, and hash blocking from within the SOAR workflow.

Category: SOC | Subcategories: EDR containment & response

Integrations: SentinelOne, Microsoft Entra ID, Mimecast, Zscaler ZIA

6. Alert Enrichment / IOC Lookup

Description: Library of enrichment subflows that look up individual observables (IP addresses, URLs, file hashes, usernames) against threat intelligence sources and write results back to the Blink case observable record. Designed to be called by the main alert processing pipeline or on demand by analysts.

Business problem: IOC context from threat intel platforms (VirusTotal, URLScan, AbuseIPDB) is essential for triage decisions but requires API integrations and data normalization. This enrichment library allows a single observable lookup to query multiple sources and return a normalized verdict automatically.

Category: SOC | Subcategories: Alert enrichment / IOC lookup, Threat intel ingest & curation

Integrations: VirusTotal, URLScan, AbuseIPDB, CrowdStrike, Okta

7. Cloud Asset Coverage & Inventory

Description: Continuous monitoring of cloud-connected assets. Polls Microsoft Intune every 15 minutes to surface enrolled devices that have compliance or hygiene issues, and ingests Microsoft Defender for Cloud Apps alerts on a 1-minute polling cycle to capture SaaS anomalies and policy violations.

Business problem: Cloud asset visibility gaps — unenrolled devices and SaaS policy violations — are among the top sources of undetected lateral movement risk. These playbooks provide continuous, automated coverage monitoring without requiring analyst polling of separate consoles.

Category: Cloud Security | Subcategories: Cloud asset coverage & inventory, Cloud access & SaaS policy mgmt

Integrations: Microsoft Intune, Microsoft Defender for Cloud Apps, Microsoft Graph API

8. Threat Intel Ingest & Curation — GreyMatter DRP

Description: Scheduled ingestion from GreyMatter's digital risk protection (DRP) platform. Polls daily for new exposed credentials alerts, weekly to populate a structured report with DRP findings (impersonating domains, exposed ports, expiring certificates), and weekly to distribute the formatted report to stakeholders.

Business problem: Digital risk alerts from DRP platforms require regular review to identify brand impersonation, credential leakage, and exposed infrastructure. Manual report compilation is time-consuming and irregular. These playbooks automate both the collection and distribution on a defined schedule.

Category: SOC | Subcategories: Threat intel ingest & curation, Security metrics & reporting

Integrations: GreyMatter DRP (HTTP API), Blink Tables, Email (SMTP)

9. Security Metrics & Reporting

Description: Scheduled reporting playbooks that calculate and distribute operational metrics. One workflow computes weekly meeting/collaboration time from Jira data, and another compiles and emails a daily report of closed case data from the tracking table.

Business problem: SOC managers need regular visibility into team workload, case throughput, and operational efficiency metrics without manually querying multiple systems. These scheduled reports deliver structured summaries directly to stakeholders.

Category: GRC | Subcategories: Security metrics & reporting

Integrations: Blink Tables, Blink Case Management, Jira (via SMTP email), Email (SMTP)

10. Agentic SOC — AI Agent Capabilities

Description: An emerging agentic capability layer with purpose-built agent abilities for sandbox analysis (Joe Sandbox), URL screenshot capture, ASN/IP intelligence lookup, and HTML email composition. Includes an agent orchestrator workspace with a brand reporting agent and a builder copilot for generating new Blink workflows programmatically.

Business problem: Complex, multi-step SOC investigations require judgment-driven orchestration that goes beyond fixed playbooks. This agent capability layer enables autonomous investigation paths — dynamically selecting and calling enrichment tools, composing reports, and even generating new automation — reducing analyst dwell time on complex incidents.

Category: SOC | Subcategories: Agentic SOC, Alert enrichment / IOC lookup

Integrations: Joe Sandbox, ARIN WHOIS, Blink Agent SDK, Blink API

11. Microsoft Defender XDR Ingestion

Description: Hourly scheduled ingestion of Microsoft Defender XDR incidents into the Blink case management platform, with a companion manual ingestion playbook for ad-hoc pulls and a subflow that updates Blink case metadata from XDR incident attributes.

Business problem: Microsoft Defender XDR generates incidents across endpoint, identity, and email that need to flow into the centralized SOAR platform for unified case management and response tracking.

Category: SOC | Subcategories: Case mgmt & SOAR, Alert enrichment / IOC lookup

Integrations: Microsoft Defender XDR, Blink Case Management

Strengths

High-volume, fully automated SOC pipeline. The alert triage and response pipeline (Process Alert v9 → Utility - Overview Builder → Subflow 4 - Response) executed over 32,000 times in 12 months. This represents a substantial volume of alerts that were processed, enriched, and responded to without analyst involvement at the triage layer.

Identity threat response at scale. The three core identity response actions — password reset (1,135), session revocation (1,125), and MFA reset (1,122) — ran with near-identical frequency, indicating they are called together as an atomic containment action. Over 3,300 account-level containment actions were completed in 12 months.

Risk-gated password reset orchestration. A parent workflow now evaluates every "Nigeria+ logins" geolocation alert (976 executions in the reporting window), checks the user's last password-reset timestamp via Entra ID, and only triggers a fresh reset if one hasn't occurred in the past two days — avoiding redundant resets while still containing genuinely new suspicious logins automatically.

Bidirectional SOAR-ticketing integration. The CSS integration is one of the more sophisticated deployments, with nearly 10,000 comment sync events and a fully mapped bidirectional status lifecycle. This keeps incident visibility consistent across the security operations team and the broader business stakeholders who use CSS.

Phishing coverage is broad and deep. Three phishing-related playbooks collectively ran over 10,000 times (3,681 triage + 3,676 analysis + 2,999 case updates), and the email analyzer includes header inspection, URL reputation, attachment hash, sender domain WHOIS, and SPF/DKIM data — a comprehensive automated analysis chain.

Emerging agentic capability. The agent workspace with Joe Sandbox, ARIN, and URL screenshot abilities represents an early-stage but architecturally significant investment. The presence of a Builder Copilot that programmatically creates new Blink workflows signals intent to use AI to accelerate automation expansion.

Gaps

EDR containment playbooks have zero executions. The full SentinelOne response library (isolate, scan, block hash, cancel isolation) and the Malicious Click orchestrator show 0 executions over 12 months. This indicates these containment actions are not yet integrated into the automated pipeline — they likely remain as on-demand analyst tools rather than automated response paths.

Enrichment library underutilized in production. The IOC enrichment subflows (VirusTotal hash, IP, URL; URLScan; AbuseIPDB; CrowdStrike; Okta) collectively have near-zero executions, suggesting enrichment is occurring through a different mechanism (possibly inline within the main pipeline) or is not yet activated. Activating automated enrichment could significantly increase case context quality.

Several playbooks remain in TEST/development state. Multiple playbooks with "Test" in their name (Test GreyMatter Exposed Creds, Test Cases Closed Report for Jira, Test Populate/Send GreyMatter Reports) are running in production. Graduating these to production-named workflows would improve operational clarity and signal readiness for scaling.

No formal vulnerability management workflows. There are no playbooks covering vulnerability scan ingestion, CVE lookup, Vuln lifecycle ticketing, or patch management. For an organization of this scale, automating the vulnerability-to-ticket pipeline represents an untapped efficiency opportunity.

A parallel "SOC" workspace is duplicating production playbooks at low volume. A second workspace now hosts near-identical copies of CSS ticketing subflows, the Entra password-reset-and-notify subflow, and the Defender case enrichment workflow — all with 0-1 executions versus their established production counterparts. This looks like an in-progress migration or workspace consolidation; worth confirming with the team whether the original or the new workspace is the intended long-term home before both are maintained indefinitely.

ServiceNow IR ingestion (SNow - IR Case Ingestion) has zero executions. The ServiceNow integration for ingesting IR incidents was built but has not run, suggesting the ServiceNow-to-Blink incident pipeline is not yet in active use.

Integration Ecosystem

The following integrations are actively connected and used in production workflows:

• Identity & Directory: Microsoft Entra ID (Active Directory), Okta
• Email Security: Microsoft Outlook / Exchange Online, Mimecast
• EDR / Endpoint: SentinelOne, Microsoft Intune
• Cloud Security: Microsoft Defender for Cloud Apps, Microsoft Defender XDR, Microsoft Graph
• Threat Intelligence: VirusTotal, URLScan, AbuseIPDB
• Sandbox Analysis: Any.run, Joe Sandbox (agent ability, not in production)
• Network Security: Zscaler ZIA
• ITSM / Ticketing: ServiceNow, Jira (via email)
• Digital Risk Protection: GreyMatter (HTTP API)
• Productivity: Microsoft Excel, Google Docs
• SOAR Platform: Blink Case Management (native)

The integration surface is deep in the Microsoft ecosystem (Entra, Defender, Intune, Outlook, Teams, Graph, Excel) reflecting a Microsoft-centric enterprise architecture. The presence of both CrowdStrike and SentinelOne enrichment/response playbooks suggests a possible EDR platform transition or dual-vendor deployment.