PreSales — Customer Success Report

*Note: This is a PreSales demonstration environment. Execution counts reflect controlled demo usage rather than production workload.*

UC1 — NGSIEM Alert Enrichment Pipeline

Description: Automated enrichment pipeline for CrowdStrike NGSIEM detections. Ingests alerts via webhook, extracts IPs, domains, and file hashes, performs multi-source threat intelligence lookups, and routes enriched findings via email.

Business problem solved: NGSIEM detections arrive with raw IOCs requiring analyst lookups across VirusTotal, AbuseIPDB, and CrowdStrike indicators. This pipeline automates triage end-to-end — from alert receipt through enrichment and analyst notification.

Integrations: CrowdStrike Falcon, VirusTotal, AbuseIPDB

Category: SOC | Subcategories: Alert enrichment / IOC lookup, SIEM & log pipeline monitoring

UC2 — Case Management & Automated SOC Response

Description: Full-featured, AI-assisted case management platform built on Blink. Automates multi-source alert ingestion (6 sources), observable extraction, deduplication, IOC enrichment across 8 enrichment providers, case creation, response routing (phishing, malware), and analyst notifications.

Business problem solved: SOC teams spend the majority of analyst time manually triaging, deduplicating, and enriching alerts across fragmented tools. This platform replaces that manual pipeline with automated flow from raw alert to enriched case with routed response — covering 6 ingestion sources.

Integrations: CrowdStrike Falcon, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, VirusTotal, AbuseIPDB, URLScan, Wiz, Azure Monitor, AWS CloudTrail, Microsoft Defender for Cloud Apps, Microsoft Outlook

Category: SOC | Subcategories: Case mgmt & SOAR, Alert enrichment / IOC lookup, EDR containment & response, Phishing detection & response

UC3 — Agentic Detection Engineering & Threat Intel

Description: AI-agent-powered detection engineering workflow. Uses named agents (Athena, a Cyber Threat Intelligence Analyst, and Hermes, a Detection Technical Writer) to process detection requests from Slack, retrieve adversary intel from CrowdStrike, generate detection rules, and retrieve lateral movement detections from Vectra.

Business problem solved: Detection engineering is bottlenecked by the time analysts spend researching threat actors, writing rule syntax, and routing requests through manual channels. This use case automates the full detection request lifecycle via Slack mention, from intake through AI-generated rule output and stakeholder notification.

Integrations: CrowdStrike Falcon (intel), Vectra RUX, Slack, Blink AI Agents (Athena — CTI Analyst, Hermes — Detection Writer)

Category: SOC | Subcategories: Agentic SOC, Threat intel ingest & curation

UC4 — Multi-Platform IAM State & Access Inventory

Description: Automated ingestion of user permissions, roles, groups, and license data from 10 identity and SaaS platforms into a centralized Blink table, plus detection of deactivated and inactive accounts in Active Directory.

Business problem solved: Access review and SaaS governance programs require a unified view of who has access to what across the entire tool stack. This use case automates the data collection phase — pulling permissions from 10 platforms into one place for review, audit, or downstream RBAC analysis.

Integrations: Microsoft Entra ID, GitHub, Slack, DataDog, Wiz, Google Workspace, Salesforce, Hubspot, Active Directory

Category: IAM | Subcategories: Access review & group mgmt, Identity sync & directory mgmt, RBAC review & access mgmt

UC5 — Cloud & Infrastructure Compliance Auditing

Description: Automated compliance checklists and CIS benchmark reporting for AWS cloud and Linux/Windows server infrastructure. Executes checks via native AWS APIs, SSH, and WinRM, and delivers results via email.

Business problem solved: Compliance teams run periodic manual checks against CIS benchmarks and internal policy baselines — SSH-ing into servers, running AWS CLI commands, and compiling results by hand. This use case automates the full data collection and reporting cycle.

Integrations: AWS (IAM, EC2), SSH (RHEL, Ubuntu), WinRM (Windows Server)

Category: Cloud Security / GRC | Subcategories: Config audit & remediation, DevSecOps compliance, RBAC review & access mgmt

UC6 — IT Helpdesk & Access Provisioning

Description: Self-service and event-driven IT automation covering secure remote access (SRA) requests, temporary user provisioning, IP blocking with approval gates, password expiry notifications, DNS record management, and firewall port management.

Business problem solved: High-volume, repetitive IT requests — access provisioning, firewall changes, DNS updates, password warnings — consume IT team bandwidth and often involve manual email chains for approvals. This use case automates the intake, approval, and execution cycle.

Integrations: Microsoft Entra ID, Microsoft Outlook, Microsoft Teams, Microsoft Defender, Nessus, Active Directory, SSH (Linux), WinRM (Windows), Email

Category: Other | Subcategories: IT helpdesk & ticket routing, JIT & temporary access, IT/OT & network infra monitoring, Password & credential lifecycle

UC7 — Demo, Test & Utility Workflows

Description: Ad-hoc demonstrations, test scaffolding, and utility workflows used during PreSales engagements or internal development. Includes data pipeline demos (CSV-to-table, SharePoint upload, Terraform provisioning), event-driven demos (Slack bot, Windows attack simulation), and blank/skeleton workflows.

Category: Other | Subcategories: DevOps & release automation, SaaS / IT administration

Strengths

Mature SOAR foundation. UC2 is the most architecturally complete use case in the environment — a production-grade case management platform spanning 6 ingest connectors, 14 enrichment providers, response routing for phishing and malware, case deduplication, observable relation management, stale case recovery, and simulation tooling. This is a comprehensive demonstration of Blink's SOAR depth.

Broadest IAM coverage of any PreSales asset. UC4 spans 10 identity and SaaS platforms (Azure, GitHub, Slack, DataDog, Wiz, Google Workspace, Salesforce, Hubspot, Okta, Active Directory) in a single normalized inventory pipeline. This directly addresses the SaaS access visibility gap that surfaces in almost every enterprise prospect conversation.

Agentic SOC differentiation. UC3 showcases two named AI agents (Athena — CTI Analyst, Hermes — Detection Technical Writer) embedded in a live Slack-driven detection engineering workflow. With 3 executions recorded, this is the most-used non-case-management use case, signaling strong prospect interest in agentic capabilities.

Multi-OS compliance coverage. UC5 covers CIS AWS, RHEL, Ubuntu, and Windows Server from a single toolset — a strong response to mixed-infrastructure compliance questions.

Broad integration ecosystem. 20+ integrations demonstrated across CrowdStrike, Microsoft (Entra ID, Outlook, Teams, Defender, Azure), Google Workspace, AWS, Okta, Slack, GitHub, Wiz, VirusTotal, AbuseIPDB, URLScan, Vectra, Salesforce, Hubspot, DataDog, and SSH/WinRM infrastructure.

Gaps

Limited production usage, concentrated in one utility. 26 total executions across 133 playbooks — 16 of them from a single internal IP address list maintenance utility (UC6) rather than the SOC/IAM demo flows. Excluding that utility, prospect-facing demo execution volume remains thin (10 executions), so the PreSales team should track which specific SOC/IAM playbooks are demonstrated most, as this remains the primary signal of prospect interest.

High enrichment pipeline duplication. UC1 contains 6+ versioned copies of IP/Hash/Domain enrichment subflows (variants, (1) suffixes, Copy suffixes) across two workspaces. This dilutes the demo narrative and makes workspace navigation confusing for prospects. Consolidation into a single canonical pipeline per IOC type is recommended.

No Vulnerability Management use cases. With CrowdStrike, Wiz, and AWS all connected, there is no vuln scanning ingestion, prioritization/ticketing, or CVE lookup workflow. This is a significant gap relative to what prospects typically evaluate alongside SOAR.

Limited GRC automation depth. UC5 covers compliance checklists well but there is nothing for vendor risk/TPRM, DSAR/privacy, RBAC review workflows, or security metrics reporting — subcategories that appear in most GRC-focused deals.

SIEM/log pipeline gaps beyond CrowdStrike. Despite SSH and WinRM infrastructure tooling, there are no Splunk, Elastic, or generic SIEM ingestion or log pipeline automation workflows. Prospects with existing SIEM investments need these bridges.

Integration Ecosystem