itogether — Customer Success Report

Use Case 1: Agentic SOC — Alert Processing Pipeline

Description: The central automated SOC orchestration engine. When a new alert lands in the case management system, this pipeline automatically extracts observables, creates or merges into an existing case (deduplication), fans out enrichment jobs for all new observables, waits for enrichment to complete, and routes to the appropriate response subflow — without analyst involvement. Recovery playbooks handle backfill for any alerts or observables that slipped through during outages.

Business Problem Solved: Eliminates manual alert triage, observable extraction, case creation, and initial enrichment — compressing the alert-to-response timeline and removing analyst toil from all routine processing.

Category: SOC | Subcategories: Agentic SOC, Case mgmt & SOAR

Key Integrations: Blink Case Management (alert, case, observable APIs), CrowdStrike, VirusTotal, AbuseIPDB, Okta, Microsoft Entra ID, Slack

Use Case 2: Multi-Source Alert Ingestion

Description: Event-driven ingestion playbooks — one per security source — that continuously poll or receive webhooks from security tools and automatically create standardized alerts in the case management system. Four of the six sources are actively running; CrowdStrike direct and LogScale ingestion are configured but not yet firing.

Business Problem Solved: Normalizes heterogeneous security telemetry from multiple platforms into a single case management view, eliminating manual aggregation and enabling consistent automated handling regardless of alert origin.

Category: SOC | Subcategories: SIEM & log pipeline monitoring, Case mgmt & SOAR, CSPM ingest & triage

Key Integrations: Wiz, Microsoft Defender for Cloud Apps, CrowdStrike, CrowdStrike Falcon LogScale, Azure Monitor, AWS CloudTrail

Use Case 3: Alert Enrichment Engine

Description: A fleet of specialized enrichment subflows — one per observable type and data source — automatically dispatched by the enrichment router during alert processing. Each subflow enriches a specific IOC type (IP, URL, hash, username, or endpoint agent ID) using the relevant data source and writes structured results back to the observable record in case management.

Business Problem Solved: Provides instant, consistent threat context on every IOC without analyst research time. Enables the automated pipeline to make informed triage and response decisions based on enriched intel at machine speed.

Category: SOC | Subcategories: Alert enrichment / IOC lookup, Threat intel ingest & curation

Key Integrations: VirusTotal, AbuseIPDB, URLScan, CrowdStrike, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack

Use Case 4: Incident Response Automation

Description: Automated response subflows triggered after case enrichment completes. The phishing subflow validates whether a flagged email is a real attack (vs. a KnowBe4 simulation) by inspecting Microsoft Outlook headers, then applies appropriate containment. The malware subflow checks whether CrowdStrike fully or partially remediated the threat and applies conditional follow-up actions.

Business Problem Solved: Converts enriched alert context into an immediate, consistent response action — without waiting for analyst availability — reducing dwell time on confirmed threats and eliminating false-positive response on training simulations.

Category: SOC | Subcategories: Phishing detection & response, EDR containment & response, Case mgmt & SOAR

Key Integrations: Microsoft Outlook, Blink Case Management

Use Case 5: EDR Containment & Remote Response

Description: On-demand and pipeline-callable playbooks for endpoint containment (isolate / lift isolation) and remote command execution on CrowdStrike-managed endpoints. Supports both targeted single-host operations and bulk batch commands across a host group.

Business Problem Solved: Enables immediate endpoint containment during active incidents and remote forensic or remediation commands without requiring direct system access — compressing response time and limiting lateral movement risk.

Category: SOC | Subcategories: EDR containment & response

Key Integrations: CrowdStrike Falcon (RTR, Host Actions)

Use Case 6: Analyst Investigation Toolkit

Description: A library of on-demand investigative playbooks enabling analysts to quickly retrieve user identity data, file reputation, network intelligence, and endpoint state from a unified interface during active investigations. These tools use the same integration connections as the automated enrichment engine and can be called manually from the case management UI or Blink portal.

Business Problem Solved: Consolidates investigative lookups across 8+ data sources into standardized, reusable tools — reducing context-switching and eliminating inconsistent manual query patterns across the analyst team.

Category: SOC | Subcategories: Alert enrichment / IOC lookup, Threat intel ingest & curation, Identity threat response

Key Integrations: Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, VirusTotal, CrowdStrike, URLScan, Whois, DNS

Use Case 7: Case Management Platform Utilities

Description: Supporting utilities and subflows that maintain the integrity and operational health of the case management data model. Covers observable relationship lifecycle (create, update, delete, list), case hygiene (stale case closure, similar-case detection), alert template validation, and operator error notification.

Business Problem Solved: Keeps the SOAR platform data model clean and self-maintaining — automatically closing dead cases, surfacing related incidents for analyst correlation, and ensuring the team is notified when the automation encounters gaps or failures.

Category: SOC | Subcategories: Case mgmt & SOAR

Key Integrations: Blink Case Management, Email (core)

Strengths

Production-grade Agentic SOC architecture. The deployment follows a well-designed, layered SOAR pattern: multi-source ingestion → automated case creation with deduplication → observable enrichment fan-out → conditional response routing. The architecture separates concerns cleanly — each layer is independently maintainable and the enrichment router decouples source-specific ingest from IOC-specific enrichment logic. Recovery playbooks and structured error notification add operational resilience.

Broad and deep integration ecosystem. 12+ distinct security tool integrations are wired up and configured, including CrowdStrike (EDR, threat intel, RTR), the full Microsoft stack (Entra ID, Defender for Cloud Apps, Azure Monitor, Outlook), VirusTotal + AbuseIPDB + URLScan (threat intel), Okta + Google Workspace + GitHub (identity), and Wiz + AWS CloudTrail (cloud security). This is a strong foundation — the connections already exist and are tested.

Complete observable type coverage. The enrichment engine covers all major IOC categories — IP addresses (two sources), domains, URLs (two sources), file hashes (two sources), usernames/emails (three identity providers + Slack), and CrowdStrike endpoint agent IDs. Cross-source enrichment on the same observable type enables automated verdict confidence scoring.

Phishing simulation awareness. The phishing response subflow specifically handles KnowBe4 simulation emails by checking for X-PHISHTEST headers before triggering containment — a mature, false-positive-aware response pattern.

Gaps & Opportunities

Platform is in early-activation phase. With 25 total executions across 12 months (16 from ingest playbooks, 9 from the core pipeline), the platform is running at POC-level volume. The architecture is production-ready — the primary gap is volume, not capability. Enabling all configured ingestion sources at production polling rates would immediately surface the full value of the enrichment and response automation.

Enrichment pipeline not yet exercised. Despite 13 enrichment subflows being fully built and connected, 0 enrichment runs have occurred. Since Process Alert did fire 5 times and called the enrichment router (8 executions), this suggests observable extraction may have yielded no enrichable IOCs in the test data, or enrichment dispatch is gated by a condition not yet met at scale. This is the highest-leverage gap to investigate.

CrowdStrike ingestion inactive. CrowdStrike is the most deeply integrated tool in the ecosystem (alert ingest, hash enrichment, agent enrichment, RTR, quarantine) but both CrowdStrike ingest playbooks show 0 executions. Activating webhook-based CrowdStrike ingest is likely the single highest-value enablement action — it would feed the pipeline with high-fidelity EDR telemetry and immediately exercise the enrichment and response automation.

Response automation not yet triggered. Both response subflows (phishing, malware) and all EDR containment playbooks show 0 executions. The routing infrastructure exists and the response router fired once — getting live phishing or malware alerts flowing through the pipeline would begin demonstrating automated MTTR reduction.

No IAM, GRC, or Cloud Security use cases beyond ingest. The deployment is entirely SOC-focused. Given that Okta, Microsoft Entra ID, and Google Workspace are already connected with active credentials, employee lifecycle automation (onboarding/offboarding/access review) is a natural adjacent expansion. Wiz and AWS CloudTrail connections similarly open the door to automated cloud posture remediation workflows.

Integration Ecosystem Summary

Use Case 1: Agentic SOC — Alert Processing Pipeline

Description: The central automated SOC orchestration engine. When a new alert lands in the case management system, this pipeline automatically extracts observables, creates or merges into an existing case (deduplication), fans out enrichment jobs for all new observables, waits for enrichment to complete, and routes to the appropriate response subflow — without analyst involvement. Recovery playbooks handle backfill for any alerts or observables that slipped through during outages.

Business Problem Solved: Eliminates manual alert triage, observable extraction, case creation, and initial enrichment — compressing the alert-to-response timeline and removing analyst toil from all routine processing.

Category: SOC | Subcategories: Agentic SOC, Case mgmt & SOAR

Key Integrations: Blink Case Management (alert, case, observable APIs), CrowdStrike, VirusTotal, AbuseIPDB, Okta, Microsoft Entra ID, Slack

Use Case 2: Multi-Source Alert Ingestion

Description: Event-driven ingestion playbooks — one per security source — that continuously poll or receive webhooks from security tools and automatically create standardized alerts in the case management system. Four of the six sources are actively running; CrowdStrike direct and LogScale ingestion are configured but not yet firing.

Business Problem Solved: Normalizes heterogeneous security telemetry from multiple platforms into a single case management view, eliminating manual aggregation and enabling consistent automated handling regardless of alert origin.

Category: SOC | Subcategories: SIEM & log pipeline monitoring, Case mgmt & SOAR, CSPM ingest & triage

Key Integrations: Wiz, Microsoft Defender for Cloud Apps, CrowdStrike, CrowdStrike Falcon LogScale, Azure Monitor, AWS CloudTrail

Use Case 3: Alert Enrichment Engine

Description: A fleet of specialized enrichment subflows — one per observable type and data source — automatically dispatched by the enrichment router during alert processing. Each subflow enriches a specific IOC type (IP, URL, hash, username, or endpoint agent ID) using the relevant data source and writes structured results back to the observable record in case management.

Business Problem Solved: Provides instant, consistent threat context on every IOC without analyst research time. Enables the automated pipeline to make informed triage and response decisions based on enriched intel at machine speed.

Category: SOC | Subcategories: Alert enrichment / IOC lookup, Threat intel ingest & curation

Key Integrations: VirusTotal, AbuseIPDB, URLScan, CrowdStrike, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack

Use Case 4: Incident Response Automation

Description: Automated response subflows triggered after case enrichment completes. The phishing subflow validates whether a flagged email is a real attack (vs. a KnowBe4 simulation) by inspecting Microsoft Outlook headers, then applies appropriate containment. The malware subflow checks whether CrowdStrike fully or partially remediated the threat and applies conditional follow-up actions.

Business Problem Solved: Converts enriched alert context into an immediate, consistent response action — without waiting for analyst availability — reducing dwell time on confirmed threats and eliminating false-positive response on training simulations.

Category: SOC | Subcategories: Phishing detection & response, EDR containment & response, Case mgmt & SOAR

Key Integrations: Microsoft Outlook, Blink Case Management

Use Case 5: EDR Containment & Remote Response

Description: On-demand and pipeline-callable playbooks for endpoint containment (isolate / lift isolation) and remote command execution on CrowdStrike-managed endpoints. Supports both targeted single-host operations and bulk batch commands across a host group.

Business Problem Solved: Enables immediate endpoint containment during active incidents and remote forensic or remediation commands without requiring direct system access — compressing response time and limiting lateral movement risk.

Category: SOC | Subcategories: EDR containment & response

Key Integrations: CrowdStrike Falcon (RTR, Host Actions)

Use Case 6: Analyst Investigation Toolkit

Description: A library of on-demand investigative playbooks enabling analysts to quickly retrieve user identity data, file reputation, network intelligence, and endpoint state from a unified interface during active investigations. These tools use the same integration connections as the automated enrichment engine and can be called manually from the case management UI or Blink portal.

Business Problem Solved: Consolidates investigative lookups across 8+ data sources into standardized, reusable tools — reducing context-switching and eliminating inconsistent manual query patterns across the analyst team.

Category: SOC | Subcategories: Alert enrichment / IOC lookup, Threat intel ingest & curation, Identity threat response

Key Integrations: Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, VirusTotal, CrowdStrike, URLScan, Whois, DNS

Use Case 7: Case Management Platform Utilities

Description: Supporting utilities and subflows that maintain the integrity and operational health of the case management data model. Covers observable relationship lifecycle (create, update, delete, list), case hygiene (stale case closure, similar-case detection), alert template validation, and operator error notification.

Business Problem Solved: Keeps the SOAR platform data model clean and self-maintaining — automatically closing dead cases, surfacing related incidents for analyst correlation, and ensuring the team is notified when the automation encounters gaps or failures.

Category: SOC | Subcategories: Case mgmt & SOAR

Key Integrations: Blink Case Management, Email (core)

Strengths

Production-grade Agentic SOC architecture. The deployment follows a well-designed, layered SOAR pattern: multi-source ingestion → automated case creation with deduplication → observable enrichment fan-out → conditional response routing. The architecture separates concerns cleanly — each layer is independently maintainable and the enrichment router decouples source-specific ingest from IOC-specific enrichment logic. Recovery playbooks and structured error notification add operational resilience.

Broad and deep integration ecosystem. 12+ distinct security tool integrations are wired up and configured, including CrowdStrike (EDR, threat intel, RTR), the full Microsoft stack (Entra ID, Defender for Cloud Apps, Azure Monitor, Outlook), VirusTotal + AbuseIPDB + URLScan (threat intel), Okta + Google Workspace + GitHub (identity), and Wiz + AWS CloudTrail (cloud security). This is a strong foundation — the connections already exist and are tested.

Complete observable type coverage. The enrichment engine covers all major IOC categories — IP addresses (two sources), domains, URLs (two sources), file hashes (two sources), usernames/emails (three identity providers + Slack), and CrowdStrike endpoint agent IDs. Cross-source enrichment on the same observable type enables automated verdict confidence scoring.

Phishing simulation awareness. The phishing response subflow specifically handles KnowBe4 simulation emails by checking for X-PHISHTEST headers before triggering containment — a mature, false-positive-aware response pattern.

Gaps & Opportunities

Platform is in early-activation phase. With 25 total executions across 12 months (16 from ingest playbooks, 9 from the core pipeline), the platform is running at POC-level volume. The architecture is production-ready — the primary gap is volume, not capability. Enabling all configured ingestion sources at production polling rates would immediately surface the full value of the enrichment and response automation.

Enrichment pipeline not yet exercised. Despite 13 enrichment subflows being fully built and connected, 0 enrichment runs have occurred. Since Process Alert did fire 5 times and called the enrichment router (8 executions), this suggests observable extraction may have yielded no enrichable IOCs in the test data, or enrichment dispatch is gated by a condition not yet met at scale. This is the highest-leverage gap to investigate.

CrowdStrike ingestion inactive. CrowdStrike is the most deeply integrated tool in the ecosystem (alert ingest, hash enrichment, agent enrichment, RTR, quarantine) but both CrowdStrike ingest playbooks show 0 executions. Activating webhook-based CrowdStrike ingest is likely the single highest-value enablement action — it would feed the pipeline with high-fidelity EDR telemetry and immediately exercise the enrichment and response automation.

Response automation not yet triggered. Both response subflows (phishing, malware) and all EDR containment playbooks show 0 executions. The routing infrastructure exists and the response router fired once — getting live phishing or malware alerts flowing through the pipeline would begin demonstrating automated MTTR reduction.

No IAM, GRC, or Cloud Security use cases beyond ingest. The deployment is entirely SOC-focused. Given that Okta, Microsoft Entra ID, and Google Workspace are already connected with active credentials, employee lifecycle automation (onboarding/offboarding/access review) is a natural adjacent expansion. Wiz and AWS CloudTrail connections similarly open the door to automated cloud posture remediation workflows.

Integration Ecosystem Summary