Nexus — Customer Success Report

1. EDR Alert Processing & Automated Triage

Description: Nexus's highest-volume automation area. Blink ingests alerts from CrowdStrike and Microsoft Defender for Endpoint in real time, automatically retrieves detection details and IOC data, enriches findings with external threat intelligence (VirusTotal), and delivers analyst-ready summaries — eliminating manual triage for more than 20,000 events per year.

Business problem solved: SOC analysts were manually pulling detection context from two separate EDR platforms and cross-referencing external threat feeds. Blink closes that loop automatically, reducing mean time to triage and freeing analyst capacity for true escalations.

Integrations: CrowdStrike, Microsoft Defender for Endpoints, VirusTotal, Email (Blink core)

Taxonomy: SOC → EDR containment & response, Alert enrichment / IOC lookup

2. IOC Lookup & Threat Enrichment

Description: A suite of on-demand playbooks that automate indicator-of-compromise lookups against VirusTotal and Hybrid Analysis. Analysts can submit a URL for scanning, check an existing scan's status, or trigger a combined multi-source lookup that queries both threat intel platforms and delivers a consolidated email report.

Business problem solved: Manual IOC lookups across multiple threat intelligence platforms are slow and inconsistent. These playbooks standardize the enrichment workflow and return structured results to the analyst inbox.

Integrations: VirusTotal, Hybrid Analysis, Email (Blink core)

Taxonomy: SOC → Alert enrichment / IOC lookup, Threat intel ingest & curation

3. Phishing & Email Security Response

Description: Automated workflows that monitor for malicious email alerts from Trellix Email Security and Alert Logic. On detection, the playbooks retrieve alert details, identify related delivered emails (including by SMTP sender), loop over affected recipients, and send coordinated response notifications. Includes a dedicated email-investigation subflow used as a reusable component.

Business problem solved: Responding to malicious email campaigns requires correlating alerts across email security platforms, identifying all exposed recipients, and notifying stakeholders — a multi-step process that Blink collapses into a single automated response.

Integrations: Trellix ETP, Alert Logic, Google Workspace / Gmail, Email (Blink core), Check Point Harmony

Taxonomy: SOC → Phishing detection & response, Alert enrichment / IOC lookup

4. Security Incident Investigation

Description: A structured set of investigation playbooks covering the most common SOC incident types: account lockouts, malware detections, and service brute-force attacks. Each playbook pulls incident context, sets enrichment variables, and routes response via conditional logic. Three confidence-tier subflows (low / medium / high) implement a tiered triage model — evaluating Tor/VPN/proxy signals and non-containment list membership before escalating or blocking. A block-sequence subflow integrates Check Point Harmony for automated network enforcement.

Business problem solved: Incident investigation workflows are frequently ad hoc, inconsistent, and undocumented. This use case formalizes a repeatable response playbook for the most common incident types, ensuring every analyst follows the same enrichment and decision logic.

Integrations: Check Point Harmony, AbuseIPDB (implied via subflow inputs), Zendesk, Microsoft Active Directory (implied), HTTP/custom APIs

Taxonomy: SOC → Case mgmt & SOAR, EDR containment & response, Alert enrichment / IOC lookup

5. Endpoint Containment

Description: On-demand containment playbooks that query a non-containment allowlist before isolating a host, ensuring safe and policy-aware endpoint isolation decisions. A duplicate of the workflow exists across two separate workspaces, indicating multi-team rollout or workspace segmentation.

Business problem solved: Uncontrolled endpoint containment can disrupt legitimate business operations. These playbooks enforce a policy check — blocking containment for allowlisted hosts — before taking action, reducing the risk of erroneous isolation.

Integrations: Blink HTTP Tables (non-containment list lookup)

Taxonomy: SOC → EDR containment & response

6. Network Security Policy Automation

Description: On-demand automation for creating security rules on Palo Alto firewalls and delivering results by email. Parameterized with full rule inputs (source, destination, application, service, zone, VSYS), enabling repeatable, auditable firewall policy changes without direct console access.

Business problem solved: Firewall rule creation is error-prone when done manually. These playbooks standardize the request-to-creation process and deliver a confirmation trail to the requesting engineer, improving both accuracy and audit readiness.

Integrations: Palo Alto Networks (PAN-OS), Email (Blink core)

Taxonomy: Cloud Security → Config audit & remediation

7. SIEM & Infrastructure Monitoring

Description: Scheduled monitoring of Alert Logic service status, with conditional alerting on state changes. Includes a simulation playbook for testing Alert Logic list-append behavior. Together these represent Nexus's tooling for verifying the health of their SIEM pipeline.

Business problem solved: Undetected SIEM outages create coverage gaps that go unnoticed until an incident. Scheduled Blink monitoring closes that loop with automated health checks and alerts.

Integrations: Alert Logic, HTTP

Taxonomy: SOC → SIEM & log pipeline monitoring

8. DevOps & Utility

Description: Supporting workflows not tied to security operations. Includes a Jenkins build log forwarder to Discord for CI/CD visibility, a getting-started Hello World template, and an untitled test automation. These are infrastructure or exploratory in nature.

Business problem solved: Build log visibility in a developer communication channel reduces the friction of tracking CI/CD pipeline status without leaving Slack/Discord.

Integrations: Jenkins, Discord, Email (Blink core)

Taxonomy: Other → DevOps & release automation

Strengths

• High-volume EDR automation is delivering real value. Two playbooks — CS EDR and Defender For Endpoint — together processed over 20,600 events in 12 months. This is among the clearest proof points of automation ROI in the portfolio: the same analyst workflow executing thousands of times without human intervention.
• Broad security stack coverage. Nexus has connected or attempted to connect a wide range of enterprise security tools: CrowdStrike, Microsoft Defender, Palo Alto PAN-OS, VirusTotal, Hybrid Analysis, Trellix ETP, Alert Logic, Check Point Harmony, AbuseIPDB, and Zendesk. This integration breadth reflects a mature, multi-vendor security environment and positions Nexus to expand automation across all these platforms.
• Tiered investigation architecture. The confidence-tier subflows (low / medium / high) indicate architectural intent: Nexus is building a structured, policy-driven triage model rather than ad hoc response scripts. This is a strong foundation for Agentic SOC patterns.
• Policy-aware containment. The non-containment allowlist check in the Containment playbooks shows operational maturity — Nexus has encoded business context into automated response logic, reducing the risk of disruptive false-positive containment actions.

Gaps & Opportunities

• 27 of 29 playbooks have zero executions. The active automation footprint is limited to two workflows. Most playbooks appear to be in testing, development, or abandoned states. Activating even a subset of the investigation and enrichment workflows could multiply the automation impact significantly.
• Duplicate and fragmented workspaces. The Containment playbook exists across two separate workspaces, and multiple CrowdStrike workflows exist in different workspaces with overlapping logic. Consolidating the workspace architecture would reduce maintenance overhead and make it easier to scale active workflows.
• Investigation workflows are built but not running. Windows Account Lockout, Malware Investigation, and Service Brute Force playbooks are fully scoped — inputs are defined and logic is structured — but show zero executions. These are prime candidates for activation, particularly given the active EDR alert volume these incident types likely generate.
• Phishing response pipeline is incomplete. Trellix and Alert Logic workflows exist but are inactive. With an active email security connection and a structured Email Investigation subflow already built, completing the trigger-to-response loop would directly support a measurable phishing response KPI.
• No IAM or GRC automation present. The current portfolio is entirely SOC and infrastructure focused. Common adjacent use cases — employee onboarding/offboarding, access reviews, and vulnerability management ticketing — are not represented and represent natural expansion opportunities.

Integration Ecosystem