Project-Retail — Customer Success Report

Total: 6 playbooks across 2 use cases.

1. Alert Enrichment — IP, Domain & Hash

Description: A layered enrichment pipeline that classifies and investigates indicators of compromise — IP addresses, domains, and file hashes — surfaced by CrowdStrike alerts. The architecture separates orchestration (Main playbooks) from enrichment logic (Subflows), enabling reuse across different alert types.

Business problem solved: Analysts spend significant time manually looking up whether an IP, domain, or file hash is malicious. This use case automates that investigation, classifies indicators as internal/external/organizational, queries threat intelligence, and delivers a formatted enrichment summary — removing manual lookup work from the alert triage loop.

Integrations observed: CrowdStrike (alert detail retrieval), Blink HTTP Tables (organizational IP/domain allow-lists), Blink Email (enrichment delivery), Python (IP classification logic, threat confidence scoring).

Taxonomy: SOC › Alert enrichment / IOC lookup

2. CrowdStrike NGSIEM Case Intake

Description: An event-driven workflow that ingests CrowdStrike NGSIEM alerts via webhook, extracts the alert ID, retrieves full alert details, and routes the case through conditional logic for triage or downstream action.

Business problem solved: Security cases generated in CrowdStrike NGSIEM need to be captured, normalized, and acted upon quickly. This workflow provides the intake layer — ensuring that every inbound CrowdStrike case is received, enriched with alert detail, and evaluated against triage conditions without manual intervention.

Integrations observed: CrowdStrike (webhook trigger, GetAlertDetails), Python (alert ID extraction), conditional branching logic.

Taxonomy: SOC › Case mgmt & SOAR, SIEM & log pipeline monitoring

Strengths

• Modular enrichment architecture. The separation of Main orchestrators from enrichment Subflows (IP / Domain / Hash) is a strong design pattern. Subflows can be reused across multiple alert types and triggers without duplication, and the architecture scales cleanly as more indicator types are added.
• Organizational context awareness. The IP and Domain enrichment mains query Blink Tables for organization-owned assets before querying external threat intelligence. This avoids false positives on internally routed IPs and org-controlled domains — a production-quality refinement that reflects real-world operational maturity.
• CrowdStrike-native integration. Both the NGSIEM Cases intake and the enrichment subflows call crowdstrike.GetAlertDetails, meaning alert context is fetched directly from the authoritative source rather than relying on potentially truncated webhook payloads.
• Confidence scoring logic. The IP Enrichment subflow includes a Python step explicitly named "Evaluate threat confidence," indicating the automation produces a risk score rather than raw data — directly supporting analyst decision-making.

Gaps

• Zero production executions. All 6 workflows show 0 executions in the last 12 months. The automation layer is built and configured but has not yet been activated in a live alert pipeline. The value of this investment is currently unrealized.
• No active trigger on enrichment mains. Both Main - IP Enrichment v2.0 and Main - Domain Enrichment v2.0 are on_demand with no event trigger wired. They are designed to be called from a parent workflow (e.g., NGSIEM Cases) but that connection has not been made — the NGSIEM Cases workflow routes through conditions but does not visibly invoke the enrichment mains.
• No alert closure or ticketing step. The pipeline enriches and scores indicators but there is no visible step that creates a ticket, updates a case status, or closes an alert. Adding a case-update action (e.g., back to CrowdStrike or a ITSM tool) would complete the loop and enable full automation of the triage cycle.
• Hash enrichment not connected. Subflow - Hash Enrichment exists but no top-level Main - Hash Enrichment orchestrator is present. Hash-based indicators would need a main flow to be operationalized.
• Email as sole output. The Domain Enrichment main sends results via Blink email. For a SOC use case, enrichment output is better delivered into the case management system (CrowdStrike case comments, a SIEM annotation, or a Slack/Teams alert) to keep the analyst in a single pane.

Integration Ecosystem