mercury-insurance — Customer Success Report

Total across all active workflows: 10,417 executions across 82 active workflows (251 total defined)

1. SIEM Log Intelligence & Search

Category: SOC | Subcategory: SIEM & log pipeline monitoring

Description: The SOC team relies on automated query workflows spanning two SIEM platforms — Google Chronicle (UDM) and CrowdStrike LogScale — to retrieve structured event data, raw logs, and detection artifacts during investigations. These workflows function as the primary data retrieval layer for every analyst investigation, enabling fast on-demand and programmatic log access without manual console queries.

Business Problem Solved: Eliminates manual SIEM console navigation during active investigations; standardizes log retrieval across Chronicle and LogScale into reusable, auditable workflows callable by analysts and other automations alike.

Integrations: Google Chronicle (UDM), CrowdStrike LogScale, ServiceNow, Microsoft Entra ID, Microsoft XDR

2. Domain & URL Threat Intelligence

Category: SOC | Subcategory: Alert enrichment / IOC lookup

Description: A coordinated multi-source threat intelligence pipeline that investigates suspicious domains, URLs, and IPs across URLScan, VirusTotal, CrowdStrike Falcon Sandbox, ThreatConnect, GitHub, and IP reputation APIs. Each source contributes a distinct signal — sandboxing, reputation scoring, WHOIS, company attribution — which are aggregated downstream into a unified verdict.

Business Problem Solved: Removes the need for analysts to manually query five or more threat intel platforms per alert; standardizes domain/URL triage into a repeatable pipeline that delivers consistent, comprehensive context in seconds.

Integrations: URLScan, VirusTotal, CrowdStrike Falcon Sandbox, ThreatConnect, GitHub, IP-API, Microsoft Teams

3. Agentic SOC Investigation

Category: SOC | Subcategories: Agentic SOC, Alert enrichment / IOC lookup

Description: Mercury Insurance has deployed Blink's AI-powered agentic SOC capability — an autonomous multi-step investigation layer that combines Glean enterprise search for internal context, Active Directory / Entra ID for user history, CrowdStrike for endpoint telemetry, and Blink's case management for case state. The agent reasons across these sources to triage alerts, determine severity, and reach automated disposition decisions.

Business Problem Solved: Reduces analyst workload on Tier-1 alert triage by enabling autonomous investigation that can gather context across six or more systems, synthesize findings, and produce an investigation summary — all without human intervention on routine alerts.

Integrations: Glean, Microsoft Active Directory, Microsoft Entra ID, CrowdStrike, Blink Case Management

4. SOC Case Management & Alert Routing

Category: SOC | Subcategory: Case mgmt & SOAR

Description: The ATG (Alert Triage & Gateway) framework automatically routes incoming security alerts from multiple sources — CrowdStrike, Proofpoint, Varonis MDDR, and Glean — into the correct ServiceNow SIR queues, attaching screenshots and enrichment artifacts. A continuous polling workflow monitors ServiceNow for active SOC alerts, and a daily export uploads all open SIRs to SharePoint for leadership visibility.

Business Problem Solved: Eliminates manual SIR creation, routing, and documentation steps for incoming alerts from five distinct detection systems; ensures consistent escalation paths and maintains a living SharePoint record of all open investigations.

Integrations: ServiceNow, CrowdStrike, Proofpoint, Varonis, Glean, Microsoft SharePoint, URLScan, Microsoft Outlook

5. Cloud Resource Utilization Reporting

Category: GRC | Subcategory: Security metrics & reporting

Description: A three-stage automated pipeline (UURR v4) that queries Chronicle for cloud user activity data, processes it in configurable weekly batches, and generates under-utilized cloud resource reports. Stage 1 initializes the report structure, Stage 2 pulls activity data, and Stage 3 handles large-scale parallel processing of resource batches — enabling reports that span thousands of cloud assets.

Business Problem Solved: Automates what would otherwise be a manual weekly analysis of cloud resource utilization across hundreds or thousands of assets; delivers consistent reports that can surface dormant accounts, unused instances, and over-provisioned resources for remediation and cost savings.

Integrations: Google Chronicle, HTTP (cloud APIs), Microsoft Active Directory

6. Compromised Credential Response

Category: IAM | Subcategory: Password & credential lifecycle

Description: A daily scheduled workflow that checks for compromised passwords across Active Directory, cross-references CrowdStrike for endpoint exposure, and automatically creates ServiceNow incidents for any confirmed compromised credential. Supporting functions enumerate all AD users and retrieve detailed user profiles to enrich the incident record.

Business Problem Solved: Closes the gap between compromised credential intelligence and remediation action; eliminates the daily manual credential hygiene review by automating detection, enrichment, and ticket creation in a single scheduled pipeline.

Integrations: Microsoft Active Directory, CrowdStrike, ServiceNow, Microsoft Outlook

7. Travel Authorization Sync

Category: SOC | Subcategory: SIEM & log pipeline monitoring

Description: A nightly scheduled workflow that pulls approved travel request RITMs from ServiceNow and synchronizes the authorized traveler list into Chronicle. This ensures that SIEM geolocation-based alerts are automatically contextualized against known approved travel, suppressing false positives for analysts when employees access systems from foreign locations.

Business Problem Solved: Prevents false positive geolocation anomaly alerts from flooding the SOC queue during employee travel; integrates HR/administrative travel approvals directly into the SIEM detection layer without manual analyst intervention.

Integrations: ServiceNow, Google Chronicle

8. Endpoint & Asset Visibility

Category: Other | Subcategory: Endpoint hygiene & MDM ops

Description: A collection of reusable access and search workflows for three endpoint/asset management platforms — Absolute (endpoint security and asset tracking), Maven, and WSS — that are queried as part of broader SOC and cloud reporting investigations. These workflows provide the authenticated connectivity layer that other investigation pipelines call when they need endpoint telemetry.

Business Problem Solved: Standardizes cross-platform endpoint and asset queries into reusable, auditable Blink workflows; makes endpoint context available to automated investigations without requiring analysts to manually navigate each platform's console.

Integrations: Absolute, ServiceNow, Maven, WSS

9. SIEM Detection Engineering

Category: SOC | Subcategory: SIEM & log pipeline monitoring

Description: Workflows supporting the creation, scoping, and validation of Chronicle detection rules, enabling the security engineering team to programmatically manage SIEM rule lifecycles without manual console access.

Business Problem Solved: Accelerates the detection engineering cycle by embedding rule validation and creation into automated, reusable workflows that can be called on demand or integrated into CI/CD-style detection pipelines.

Integrations: Google Chronicle

10. Firewall Change Request Automation

Category: Other | Subcategory: IT helpdesk & ticket routing

Description: An event-driven workflow that monitors ServiceNow for firewall change request catalog items and automatically generates AI-powered firewall rule recommendations. When a new matching request is created, Blink retrieves context, applies policy logic, and produces actionable guidance to accelerate the network security review process.

Business Problem Solved: Removes the manual triage step where network security engineers first read the change request, look up context, and draft recommendations; automates the initial analysis so engineers receive a pre-populated recommendation and can focus on approval/adjustment.

Integrations: ServiceNow

Strengths

Chronicle-centric SIEM posture. Mercury Insurance has deeply integrated Google Chronicle as its primary SIEM. The 6,903 UDM Log Search executions — by far the highest single-workflow count — confirm that Chronicle query automation is the backbone of the SOC investigation workflow. The adjacent UURR pipeline also reads Chronicle for cloud activity reporting, making it a multi-purpose analytical hub.

Dual-SIEM coverage. In parallel with Chronicle, the team runs CrowdStrike LogScale (384 executions) as a second SIEM tier. The coexistence of both SIEM query workflows suggests active usage of LogScale for CrowdStrike-native telemetry while Chronicle handles broader log coverage.

Mature threat intelligence pipeline. The domain/URL investigation cluster (URLScan, VirusTotal, Falcon Sandbox, ThreatConnect, GitHub, IP-API) represents one of the most sophisticated multi-source IOC enrichment setups in the Blink customer base. The separate "Downstream Aggregator" subflow (65 executions) confirms that results from all five upstream sources are being synthesized into unified verdicts.

Agentic SOC in active production. The 391 executions of SubFlow - Agentic - User or Admin Info Search combined with 23 completed Agentic SOC - Main - AI Investigation runs confirms that Mercury has moved beyond piloting AI-assisted triage — it is running in production with an active decision layer, expert agent layer, and case management integration.

Operational discipline around false-positive suppression. The Chronicle COC travel table update workflow (40 executions) is a notable operational maturity signal: the team is proactively syncing travel authorization data into the SIEM to contextualize geolocation anomalies, rather than relying on analysts to manually validate each alert.

ATG alert routing framework. The existence of ATG - Email Switch Case as a unified router for CrowdStrike, Proofpoint, and Varonis escalation paths indicates the team has built a standardized alert ingestion and routing framework — rather than one-off integrations for each source.

Gaps & Opportunities

Phishing response not yet automated. Despite having Proofpoint connected (via ATG escalation) and phishing response subflows defined in the case management workspace (with 0 executions), there is no active phishing investigation or remediation pipeline in production. Mercury has the infrastructure for it but has not yet wired it end-to-end.

Identity threat response (Okta) is dormant. Okta enrichment workflows are deployed across multiple workspaces but have 0 executions. If Okta is the primary IdP, this is a significant gap — identity-based threats are not being enriched from the IdP directly.

Vulnerability management is absent. No vulnerability scanning ingestion, CVE lookup, or vuln ticketing workflows are present. This is a common expansion area for teams that have matured their SOC operations.

DLP response not in production. A DLP - Open and Investigate Incident - ITM workflow (Proofpoint ITM) exists but has never run. Data exposure response is unautomated.

Multiple workflow versions in parallel. The UURR pipeline has v4 and v5 variants deployed simultaneously; the password response workflow has both prod and test variants active. Consolidating and deprecating unused versions would reduce operational clutter and confusion.

Error handling at scale. The On Workflow Failure handler ran 179 times — suggesting a meaningful number of workflow failures. This warrants a review of which workflows are generating the failures and whether they represent fixable reliability issues.

Integration Ecosystem