Arco: Experts in Safety — Customer Success Report

Use Case 1: Endpoint Security & Threat Event Visibility

Description: Monitors, queries, and inventories endpoint security data from Check Point Harmony and Check Point Infinity Events. Enables security teams to surface critical events, pull custom data queries, and maintain an up-to-date asset register — all distributed via email for stakeholder visibility.

Business problem solved: Security teams using Check Point struggle to surface actionable endpoint event data and keep asset records current without manual console work. These playbooks automate event querying, asset inventory updates, and reporting distribution.

Integrations: Check Point Harmony, Check Point Infinity Events, Email (Blink core)

Use Case 2: Identity Security & MFA Compliance

Description: Audits the Okta identity environment for MFA gaps across the user population and monitors Okta logs for failed authentication patterns. Surfaces identity hygiene gaps before they become exploitable weaknesses.

Business problem solved: Manually reviewing MFA enrollment status and authentication anomalies across a large Okta directory is time-consuming and error-prone. These playbooks automate MFA gap detection and failed-login log analysis to give the security team continuous visibility without console-level access to Okta reports.

Integrations: Okta

Use Case 3: Compliance & eDiscovery

Description: Automates the creation of compliance content searches in Microsoft Exchange Online and delivers results to designated stakeholders via email.

Business problem solved: eDiscovery and compliance search requests typically require specialized admin access to Exchange Online and manual report compilation. This playbook operationalizes the request-to-result workflow end-to-end.

Integrations: Microsoft Exchange Online, Email (Blink core)

Use Case 4: Web Application Asset Inventory

Description: Retrieves the full list of sites protected by Imperva and distributes the inventory via email for asset tracking and coverage reviews.

Business problem solved: Keeping an accurate inventory of web assets under WAF/CDN protection requires manual pulls from Imperva. This playbook automates site enumeration and routes results to the appropriate team.

Integrations: Imperva, Email (Blink core)

Use Case 5: IT Service Management

Description: Automates ticket creation in Freshservice and provides asset-level reporting from the Freshservice CMDB. Bridges security operations with the IT service desk.

Business problem solved: Security-driven service requests — such as device remediation or access changes — require manual ticket creation and cross-system data pulls. These playbooks connect security workflows to the ITSM layer.

Integrations: Freshservice, HTTP

Use Case 6: Communication & Productivity Utilities

Description: Miscellaneous operational playbooks for testing notification channels and managing email-based data workflows. Includes a Microsoft Teams notification test and an Outlook-based unsubscribe email sorter.

Business problem solved: Validating alerting pipelines and triaging inbox data are recurring operational tasks. These playbooks were built to test integrations or handle one-off data-wrangling needs.

Integrations: Microsoft Teams, Microsoft Outlook

Strengths

• Check Point Harmony depth: The largest cluster of playbooks (6 out of 14) is built around Check Point Harmony and Infinity Events, reflecting a primary security platform investment. The asset table update playbook is already active, providing a foundation for broader event-driven automation.
• Identity hygiene coverage: The MFA gap report in Okta is actively running, indicating that the team is using Blink for ongoing IAM compliance visibility — a high-value, recurring use case.
• Broad integration footprint: The tenant has connected 7 distinct platforms (Okta, Check Point Harmony, Check Point Infinity Events, Imperva, Freshservice, Microsoft Exchange Online, Microsoft Teams/Outlook), showing infrastructure readiness for deeper automation across multiple domains.

Gaps & Opportunities

• Low activation rate: Only 2 of 14 playbooks (14%) have run in the last 12 months. The majority of the library has been built but not operationalized. Converting even 5–6 of the dormant playbooks to scheduled or trigger-based runs would meaningfully expand automated coverage.
• No triggered/scheduled automations visible: All playbooks are on_demand with no event-driven or scheduled triggers apparent in the YAML. Introducing cron or webhook-based triggers — especially for event querying (Check Point) and MFA auditing (Okta) — would shift the program from reactive to proactive.
• ITSM integration underutilized: The Freshservice playbooks have zero executions. Connecting security event workflows (e.g., a critical Check Point event → auto-create Freshservice ticket) would close the loop between detection and response tracking.
• IAM threat detection in draft: The Okta failed-authentication monitoring playbook ("New Workflow") has never run and lacks a production-grade name, suggesting it was prototyped but not productionized. Formalizing this as a scheduled or event-triggered detection workflow would add meaningful identity threat visibility.
• Imperva asset coverage unvalidated: The Imperva site inventory playbook has not run, leaving web asset visibility to manual processes. A scheduled weekly pull would give the team a low-effort, always-current asset register.

Integration Ecosystem

Use Case 1: Endpoint Security & Threat Event Visibility

Description: Monitors, queries, and inventories endpoint security data from Check Point Harmony and Check Point Infinity Events. Enables security teams to surface critical events, pull custom data queries, and maintain an up-to-date asset register — all distributed via email for stakeholder visibility.

Business problem solved: Security teams using Check Point struggle to surface actionable endpoint event data and keep asset records current without manual console work. These playbooks automate event querying, asset inventory updates, and reporting distribution.

Integrations: Check Point Harmony, Check Point Infinity Events, Email (Blink core)

Use Case 2: Identity Security & MFA Compliance

Description: Audits the Okta identity environment for MFA gaps across the user population and monitors Okta logs for failed authentication patterns. Surfaces identity hygiene gaps before they become exploitable weaknesses.

Business problem solved: Manually reviewing MFA enrollment status and authentication anomalies across a large Okta directory is time-consuming and error-prone. These playbooks automate MFA gap detection and failed-login log analysis to give the security team continuous visibility without console-level access to Okta reports.

Integrations: Okta

Use Case 3: Compliance & eDiscovery

Description: Automates the creation of compliance content searches in Microsoft Exchange Online and delivers results to designated stakeholders via email.

Business problem solved: eDiscovery and compliance search requests typically require specialized admin access to Exchange Online and manual report compilation. This playbook operationalizes the request-to-result workflow end-to-end.

Integrations: Microsoft Exchange Online, Email (Blink core)

Use Case 4: Web Application Asset Inventory

Description: Retrieves the full list of sites protected by Imperva and distributes the inventory via email for asset tracking and coverage reviews.

Business problem solved: Keeping an accurate inventory of web assets under WAF/CDN protection requires manual pulls from Imperva. This playbook automates site enumeration and routes results to the appropriate team.

Integrations: Imperva, Email (Blink core)

Use Case 5: IT Service Management

Description: Automates ticket creation in Freshservice and provides asset-level reporting from the Freshservice CMDB. Bridges security operations with the IT service desk.

Business problem solved: Security-driven service requests — such as device remediation or access changes — require manual ticket creation and cross-system data pulls. These playbooks connect security workflows to the ITSM layer.

Integrations: Freshservice, HTTP

Use Case 6: Communication & Productivity Utilities

Description: Miscellaneous operational playbooks for testing notification channels and managing email-based data workflows. Includes a Microsoft Teams notification test and an Outlook-based unsubscribe email sorter.

Business problem solved: Validating alerting pipelines and triaging inbox data are recurring operational tasks. These playbooks were built to test integrations or handle one-off data-wrangling needs.

Integrations: Microsoft Teams, Microsoft Outlook

Strengths

• Check Point Harmony depth: The largest cluster of playbooks (6 out of 14) is built around Check Point Harmony and Infinity Events, reflecting a primary security platform investment. The asset table update playbook is already active, providing a foundation for broader event-driven automation.
• Identity hygiene coverage: The MFA gap report in Okta is actively running, indicating that the team is using Blink for ongoing IAM compliance visibility — a high-value, recurring use case.
• Broad integration footprint: The tenant has connected 7 distinct platforms (Okta, Check Point Harmony, Check Point Infinity Events, Imperva, Freshservice, Microsoft Exchange Online, Microsoft Teams/Outlook), showing infrastructure readiness for deeper automation across multiple domains.

Gaps & Opportunities

• Low activation rate: Only 2 of 14 playbooks (14%) have run in the last 12 months. The majority of the library has been built but not operationalized. Converting even 5–6 of the dormant playbooks to scheduled or trigger-based runs would meaningfully expand automated coverage.
• No triggered/scheduled automations visible: All playbooks are on_demand with no event-driven or scheduled triggers apparent in the YAML. Introducing cron or webhook-based triggers — especially for event querying (Check Point) and MFA auditing (Okta) — would shift the program from reactive to proactive.
• ITSM integration underutilized: The Freshservice playbooks have zero executions. Connecting security event workflows (e.g., a critical Check Point event → auto-create Freshservice ticket) would close the loop between detection and response tracking.
• IAM threat detection in draft: The Okta failed-authentication monitoring playbook ("New Workflow") has never run and lacks a production-grade name, suggesting it was prototyped but not productionized. Formalizing this as a scheduled or event-triggered detection workflow would add meaningful identity threat visibility.
• Imperva asset coverage unvalidated: The Imperva site inventory playbook has not run, leaving web asset visibility to manual processes. A scheduled weekly pull would give the team a low-effort, always-current asset register.

Integration Ecosystem