Project-falcon — Customer Success Report

1. Automated Alert Triage & IOC Enrichment

Description: Ingests CrowdStrike NGSIEM webhook events and automatically enriches the threat indicators (IPs, domains, file hashes) found in each alert. Enrichment results are classified, scored for threat confidence, and surfaced to analysts — reducing the volume of alerts requiring manual investigation.

Business problem: The SOC receives a high volume of CrowdStrike NGSIEM alerts. Manually looking up every IP, domain, or hash indicator is slow and inconsistent. This use case automates the enrichment pipeline end-to-end, from webhook ingestion through indicator classification, so analysts receive a pre-assessed alert rather than raw telemetry.

Integrations: CrowdStrike Falcon / NGSIEM (webhook trigger, alert detail retrieval), Blink Tables (public IP/domain allowlists, enrichment cache), Blink Core Python (threat confidence scoring, data formatting), Email (analyst notification)

2. Network IOC Blocking & Perimeter Enforcement

Description: Provides a structured, auditable workflow for blocking and unblocking malicious IP addresses in the Palo Alto Firewall. Covers both reactive blocking triggered by an IOC request and proactive configuration commit management to ensure changes take effect.

Business problem: Blocking a malicious IP in a firewall is error-prone when done manually — wrong subnet masks, missed commits, no audit trail. This use case ensures every block/unblock action goes through a consistent, documented process that includes validation, firewall commit, and status confirmation.

Integrations: Palo Alto Networks PAN-OS (ExecuteAPICommand for address group management and commit), Blink Core Python (data cleaning, input normalization)

Strengths

• High-volume alert automation is live and running. The NGSIEM Cases pipeline processed 460 CrowdStrike alerts over 12 months with automatic IP enrichment on every case — this is a fully operational tier-1 triage bypass.
• Domain enrichment is active and covers a meaningful subset. 110 domain enrichments ran, suggesting domain-bearing alerts are a significant portion of the alert mix (~24% of total alerts).
• Firewall response is codified and auditable. The Palo Alto blocking stack (request → block → commit) is in place with an explicit IOC blocking request flow that captures reason and ticket number, meeting audit and change-management requirements.
• Production workspace is clearly separated. All active executions run in workspace 4573c11f (NGSIEM, IP enrichment, domain enrichment) with a clean separation from the secondary workspace 0b00076c (firewall management, inactive duplicates), indicating deliberate workspace hygiene.

Gaps & Opportunities

• Hash enrichment has never run. The Subflow - Hash Enrichment playbook exists but has 0 executions. If CrowdStrike alerts surface file hash (SHA-256) indicators, this enrichment path is currently dormant — enabling it would close a gap in the IOC enrichment coverage.
• Domain enrichment subflow appears unused. Despite Main - Domain Enrichment running 110 times, the Subflow - Domain Enrichment in the production workspace has 0 executions. This may indicate the main flow handles enrichment inline without delegating to the subflow, or the subflow was replaced and can be retired.
• Inactive workspace duplicates add maintenance risk. Workspace 0b00076c holds non-executing copies of NGSIEM Cases, Main - IP Enrichment v2.0, and Main - Domain Enrichment v2.0. If not intentionally kept as staging, they should be archived to prevent confusion during future updates.
• IOC blocking volume is low relative to alert volume. Only 8 IPs were blocked across 460 triaged alerts (~1.7%). This is plausible if enrichment is doing its job and most alerts are resolved without containment — but it's worth confirming that the block workflows are being surfaced to analysts in the alert output.
• No case management or ticketing integration visible. The enrichment pipeline sends email but does not appear to create tickets in a SIEM or ITSM platform (e.g., ServiceNow, Jira, Splunk). Adding a bi-directional case sync would close the loop between Blink automation and the broader SOC workflow.

Integration Ecosystem