motivhealth — Customer Success Report

1. Agentic IT Helpdesk & AI Request Triage

Description: AI-powered triage of inbound IT service requests arriving via Microsoft Teams. When a team member pins or tags a message, Blink captures it, invokes Claude to classify the request and extract key context, creates a ClickUp task, and notifies the requester — removing the manual intake step entirely.

Business Problem Solved: IT teams spend significant time manually reading, categorizing, and routing inbound requests from Teams DMs. This use case eliminates that triage overhead, ensuring every flagged message is processed consistently, logged in a tracking system, and acknowledged within minutes.

Integrations: Microsoft Teams, Anthropic Claude, ClickUp, Blink Tables

2. SOC Automation & Case Management

Description: A full case management and SOAR pipeline built natively in Blink. New alerts from any source are ingested, observables are extracted, cases are deduplicated and created, enrichment is triggered in parallel, and automated response playbooks are dispatched based on alert type (phishing, malware). Utility workflows support observable relationship tracking, stale case hygiene, and recovery handling for missed alerts. A Claude-powered triage module is available for AI-assisted analyst support.

Business Problem Solved: Security teams face alert fatigue and inconsistent incident handling when alert processing is manual. This pipeline automates the full alert-to-case lifecycle — ensuring every alert is processed, deduplicated against existing cases, enriched, and routed to the appropriate response workflow within minutes of detection.

Integrations: Blink Case Management, CrowdStrike, Okta, Microsoft Outlook, Anthropic Claude, Darktrace

3. Alert Enrichment & IOC Lookup

Description: A comprehensive library of enrichment playbooks that look up observables — IP addresses, domains, URLs, file hashes, usernames, and email addresses — across 8+ threat intelligence and identity sources, storing structured results back into the case management system. Observable relationship utilities support linking and querying connections between alerts and observables.

Business Problem Solved: Manual IOC lookup across multiple tools is time-consuming and inconsistent. This enrichment layer automatically queries multiple data sources for every observable in a case, giving analysts a complete threat picture within seconds of alert creation, without leaving the case management interface.

Integrations: CrowdStrike, VirusTotal, URLScan, AbuseIPDB, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, Whois, Blink Case Management

4. EDR Containment & Endpoint Response

Description: Playbooks for containing compromised or lost endpoints via CrowdStrike and Aurora (Cylance), including remote triage commands, host isolation, device lock/wipe workflows, and coordinated lost/stolen laptop response that spans identity revocation, asset tracking, and management approval.

Business Problem Solved: When an endpoint is compromised or a device is lost, response time is critical. These playbooks enable instant isolation and containment actions from Blink, removing the need for analysts to manually navigate multiple EDR consoles, and ensure that lost/stolen device incidents are handled with a consistent, documented, multi-step response.

Integrations: CrowdStrike (RTR & Host Actions), Aurora/Cylance, Microsoft Entra ID, Snipe-IT, ClickUp, Microsoft Teams

5. Employee Onboarding & Identity Management

Description: End-to-end employee lifecycle automation covering new hire provisioning and access management. The onboarding workflows span BambooHR-triggered and web-form-triggered flows, provisioning accounts in both cloud (Microsoft Entra ID) and on-premises (Local AD) environments, assigning security groups by department, checking out hardware in Snipe-IT, and notifying stakeholders via Teams and email. Supporting workflows handle access group management and disable offboarded accounts in Local AD.

Business Problem Solved: Manual employee onboarding involves coordinating across HR systems, Active Directory, IT asset management, and multiple communications channels — creating delays and risk of missed steps. These workflows codify the entire checklist into a repeatable, auditable process that executes within minutes of a new hire trigger.

Integrations: BambooHR (webhook), Microsoft Entra ID (Azure AD), Local AD (WinRM), Snipe-IT, ClickUp, Microsoft Teams, Email

6. Network Infrastructure Automated Patching

Description: Scheduled workflows that run automated Windows Update commands over WinRM on four named network gateway servers (PWR-GTWY-01 through 04), verifying patch status and conditionally taking action after each run. All four execute on the same monthly schedule.

Business Problem Solved: Manually patching network infrastructure devices requires scheduling maintenance windows and manual SSH/RDP access. These workflows automate patch execution and verification on a fixed schedule, reducing operational burden and ensuring gateways stay current without analyst involvement.

Integrations: WinRM (Windows Remote Management)

7. IT Asset & SaaS Administration

Description: Automations that keep IT asset data and SaaS platforms in sync. The ClickUp-to-Snipe-IT sync updates asset statuses in the hardware tracking system whenever a ClickUp ticket is updated. The WordPress workflows audit plugins across a multisite installation on a weekly schedule, and allow on-demand plugin inspection by IT staff via a Teams-based interactive selector.

Business Problem Solved: Keeping asset inventory and SaaS platform state synchronized across tools manually is error-prone and time-consuming. These automations ensure asset lifecycle changes in the ticketing system are reflected in hardware inventory in real time, and that WordPress plugin hygiene is audited regularly without manual effort.

Integrations: ClickUp, Snipe-IT, WordPress API, Microsoft Teams

8. Vulnerability Notification

Description: Fetches vulnerability data from the Intruder scanning platform, formats it into a summary report, and sends a notification email to designated recipients.

Business Problem Solved: Security teams need to distribute vulnerability scan results to stakeholders without requiring manual export and formatting. This automation ensures findings are pushed to the right people immediately after a scan, reducing time-to-awareness for newly discovered exposures.

Integrations: Intruder, SendGrid, Microsoft Outlook

Strengths

Deep SOC investment, fully built but not yet in production. The largest portion of the automation estate — a complete alert-to-case pipeline (Process Alert → Extract Observables → Enrich → Respond) with 50+ supporting playbooks — is fully built but shows zero executions over 12 months. This represents significant platform investment and readiness; the infrastructure is in place to handle high-volume SOC operations the moment the pipeline is activated.

Agentic AI is the only live, high-volume use case. The Microsoft Teams DM triage workflow (Incoming Message Tagged → Process Incoming DM) is the most active automation in the environment, processing 65 events in 12 months using Claude for classification and ClickUp for ticket creation. This is a genuinely differentiated, AI-native use case demonstrating that the team is comfortable with agentic automation patterns.

Broad enrichment coverage across 8+ sources. The enrichment library covers CrowdStrike, VirusTotal, URLScan, AbuseIPDB, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, and Whois. Once the SOC pipeline goes live, this enrichment depth will provide immediate, multi-source context on every observable without analyst effort.

Dual-platform EDR readiness. The environment has containment playbooks for both CrowdStrike (RTR, isolation) and Aurora/Cylance, covering both real-time response and device lockdown — giving the SOC flexibility regardless of which EDR is primary on a given endpoint.

Infrastructure automation running reliably. The four PWR-GTWY auto-update workflows are executing on schedule, demonstrating that Blink is trusted for production-level operational automation, not just security tooling.

Gaps & Opportunities

SOC pipeline activation is the highest-value near-term action. The Process Alert workflow and all downstream enrichment/response playbooks are at zero executions. If CrowdStrike and Okta alerts are currently being processed manually, activating this pipeline could be the single highest-ROI change available — turning the entire existing SOC automation investment into production value.

Employee onboarding has no executions despite being fully built. Both the BambooHR webhook-triggered and web-form-triggered onboarding workflows are at zero. Given the complexity of the Onboard New Employee playbook (Entra ID provisioning, Local AD creation, Snipe-IT hardware checkout, ClickUp ticketing, Teams notifications), activating this would deliver significant time savings per hire.

Vulnerability notification is a single, on-demand playbook with no executions. Intruder is connected but the workflow runs only when manually triggered. Converting this to a scheduled or webhook-triggered flow would ensure findings are distributed automatically after every scan.

No cloud security coverage. There are no automations in the CSPM, cloud config audit, or cloud asset inventory categories. If MotivHealth operates cloud workloads (AWS, Azure, GCP), this is an unaddressed area for platform expansion.

Duplicate active workflows suggest ongoing iteration. The "(Eyes emoji) Process Incoming DM copy" workflow running alongside "Process Incoming DM (Push-Pin)" suggests a version-in-progress. Consolidating these reduces operational risk from split execution counts and divergent logic.

Integration Ecosystem