Project-red-phoenix-prod — Customer Success Report

Use Case 1 — Multi-Platform IOC Blocking & Remediation

Description: Automated enforcement of IP, domain, and URL block/unblock actions across Palo Alto Firewall, Zscaler Internet Access (ZIA), and Microsoft O365 Conditional Access. When a threat indicator needs to be contained or an earlier block needs reversal, Blink executes the full action — including configuration commits — without requiring a network engineer to log into each platform.

Business problem solved: Network perimeter containment is a time-sensitive operation. Manual blocking across three separate platforms (NGFW, internet proxy, cloud access) requires multiple logins, command expertise, and coordination. This use case reduces mean time to contain (MTTC) for IP/domain-based threats from hours to seconds.

Category: SOC

Subcategories: EDR containment & response, Threat intel ingest & curation

Integrations: Palo Alto PAN-OS, Zscaler Internet Access (ZIA), Microsoft O365

Use Case 2 — ServiceNow-Driven IOC Request Fulfillment

Description: End-to-end automation of ServiceNow Service Catalog Task (SCTASK) IOC blocking requests. When a security team member or approver submits a blocking request through ServiceNow, Blink handles the full workflow: parsing the RITM/SCTASK data, routing to the appropriate enforcement platform, executing the block action, and updating the ticket with status and approver notifications via email.

Business problem solved: Blocking requests that travel through ITSM workflows traditionally stall on manual handoffs between the ticketing system and the enforcement tool. This use case eliminates that gap — the SCTASK triggers Blink, which fulfills the request and closes the loop back in ServiceNow automatically, reducing fulfillment time and audit trail gaps.

Category: SOC

Subcategories: Case mgmt & SOAR, Threat intel ingest & curation

Integrations: ServiceNow (HTTP/Tables API), Palo Alto PAN-OS, Zscaler Internet Access, Microsoft O365

Use Case 3 — Alert Enrichment & IOC Investigation

Description: On-demand enrichment of threat indicators (IPs, domains, file hashes) surfaced from CrowdStrike alerts. Each enrichment workflow retrieves alert context from CrowdStrike Falcon, queries threat intelligence sources, classifies the indicator (private/organizational/external), evaluates threat confidence, and returns a structured enrichment output. Domain and IP workflows also check against internal allowlists to reduce false positives.

Business problem solved: SOC analysts spend significant time pivoting between alert tools and threat intelligence platforms to understand whether an indicator is genuinely malicious. These workflows automate that investigation loop, delivering enriched context alongside the alert so analysts can make faster, better-informed decisions.

Category: SOC

Subcategories: Alert enrichment / IOC lookup, Agentic SOC

Integrations: CrowdStrike Falcon, ServiceNow (HTTP/Tables API for IP cache), Email (Blink core)

Use Case 4 — SIEM Case Ingestion & Triage

Description: Event-driven ingestion of CrowdStrike NGSIEM detection cases via webhook. When CrowdStrike fires a case event, the workflow extracts the alert ID, retrieves full alert details from the Falcon API, and applies conditional logic to triage and route the case.

Business problem solved: SIEM-generated cases require immediate intake and qualification before they can be acted on. This webhook-driven flow eliminates manual alert pickup from the SIEM console, ensuring every case enters the response pipeline automatically.

Category: SOC

Subcategories: SIEM & log pipeline monitoring, Case mgmt & SOAR

Integrations: CrowdStrike Falcon (webhook + API)

Strengths

• Multi-platform containment is live and operational. The IOC blocking stack across Palo Alto, Zscaler, and O365 is the most mature and actively used capability, with 27 total blocking/unblocking executions in the last 12 months. The Palo Alto integration is the most exercised (13 block + 4 commit + 2 unblock = 19 actions).

• ServiceNow integration bridges ITSM and enforcement. The SCTASK workflows close the gap between ticketing and execution — requests submitted in ServiceNow are fulfilled automatically without a human relaying the action to the security tool. This is a high-value automation that removes a class of manual handoffs entirely.

• Broad enforcement coverage. Three distinct enforcement points are automated: network perimeter (Palo Alto NGFW), internet/web proxy (Zscaler ZIA), and cloud/SaaS access (Microsoft O365). This provides defense-in-depth containment from a single orchestration layer.

Gaps & Opportunities

• Alert enrichment workflows have zero executions. The IP, domain, and hash enrichment flows (including both Main v2.0 workflows) show no activity. These are built and ready — the gap is likely in trigger wiring (they appear to be on-demand only, with no event trigger). Connecting them to the NGSIEM Cases ingestion flow or a CrowdStrike alert trigger would unlock automated enrichment on every incoming alert.

• NGSIEM Cases workflow is inactive. The CrowdStrike webhook trigger for SIEM case ingestion has 0 executions. If the CrowdStrike–Blink webhook is not yet configured, that is the single highest-leverage setup action: it would feed all downstream enrichment and potentially the containment flows automatically.

• No automated detection-to-containment pipeline. Today, blocking and enrichment are operated separately and largely on-demand. Connecting NGSIEM Cases → enrichment subflows → conditional block actions would create a closed-loop detection-to-containment pipeline without analyst involvement for high-confidence indicators.

• Unblock flows underutilized relative to block flows. With 13 Palo Alto blocks but only 2 unblocks, there may be accumulation of stale block entries. Automated block expiry or periodic review automation could help prevent over-blocking and reduce false-positive impact.

Integration Ecosystem