Nexus Orion MSSP — Customer Success Report

1. Automated Incident Ticketing

Description: Listens for CrowdStrike webhook events and automatically creates service tickets for incoming security incidents. Supports both the primary SOC environment and the ILC managed-client environment, enabling the MSSP to scale incident intake across tenants without manual triage overhead.

Business problem solved: MSSP analysts were spending significant time manually logging CrowdStrike detections into the ticketing system. This automation converts every webhook-triggered event into a structured ticket instantly, ensuring nothing is missed and SLA timers start immediately.

Category: SOC

Subcategory: Case mgmt & SOAR

Integrations: CrowdStrike (webhook trigger)

2. Malware EDR Investigation

Description: Provides automated malware investigation for CrowdStrike EDR detections. Takes a detection ID and file hash as inputs, runs the hash against VirusTotal and Hybrid Analysis for threat intelligence enrichment, and produces a consolidated investigation summary linked to a Zendesk ticket.

Business problem solved: Malware triage requires analysts to manually pivot across multiple threat intel platforms (VirusTotal, Hybrid Analysis) for every file hash. This use case automates the full investigation chain — from EDR detection to enriched verdict — freeing analysts to focus on response decisions rather than data collection.

Category: SOC

Subcategory: EDR containment & response, Alert enrichment / IOC lookup

Integrations: CrowdStrike (EDR), VirusTotal, Hybrid Analysis, Zendesk

Strengths

• High-volume incident ticketing at scale: The ILC client ticketing automation alone processed 3,815 incidents in 12 months — demonstrating the MSSP's ability to handle enterprise-scale alert volume for managed clients without linear analyst headcount growth.
• Dual-workspace architecture: Nexus Orion MSSP operates a dedicated production SOC workspace and a separate dev/UAT workspace, indicating a mature deployment practice with proper staging and promotion controls.
• Integrated malware investigation pipeline: The malware EDR investigation use case spans CrowdStrike, VirusTotal, Hybrid Analysis, and Zendesk in a single automated workflow — covering the full detection-to-verdict-to-ticket lifecycle.

Gaps & Opportunities

• Low utilization of dev-workspace playbooks: Five of eight playbooks have zero executions and all reside in the dev/UAT workspace. The production version of PRD - Malware Generic Investigation EDR in the dev workspace has never run, suggesting it may be a staging copy that was superseded by the Orion SOC workspace version. These should either be promoted or retired to reduce maintenance surface.
• No active threat intel tooling: VT File Hash Search and CSV Output and HA Hash Search with Output Checks are standalone helper playbooks with zero executions. If these are subflows consumed by the malware investigation workflow, they should be confirmed as such; if they are standalone, activating them for on-demand analyst use could increase threat intel coverage.
• Single active use case category: All active automation falls within SOC / Case mgmt & SOAR and EDR response. There is no coverage yet for vulnerability management, IAM, or GRC — areas where MSSP clients commonly have automation needs and where Blink can expand the engagement.
• No phishing or identity threat coverage: Given the MSSP context and CrowdStrike-centric environment, phishing detection and identity threat response workflows (e.g., auto-isolating compromised accounts) are natural next use cases to build out.

Integration Ecosystem