O&M — Customer Success Report

\* Enrichment playbooks run as subflows invoked by Process Alert; individual execution counts are not tracked at the subflow level.

Alert Ingestion & Source Integration

This use case covers the intake layer of the agentic SOC pipeline, ingesting alerts and investigation events from multiple security platforms into the Blink case management environment.

Business problem solved: Security teams operating across multiple detection platforms are forced to context-switch between consoles. These playbooks normalize and centralize alert ingestion so every signal enters a single structured pipeline regardless of source.

Integrations: Rapid7 InsightIDR, Microsoft Defender for Cloud Apps, Azure Monitor, AWS CloudTrail, Wiz, CrowdStrike Falcon, custom webhook

Alert Processing & Case Deduplication

The core orchestration layer of the agentic SOC pipeline — Process Alert receives normalized alerts, extracts observables, deduplicates against existing cases, and routes to enrichment and response.

Business problem solved: Without automated deduplication and orchestration, analysts manually review duplicate alerts and repeat enrichment steps for the same indicators. This pipeline eliminates redundant work by linking related alerts to existing cases and triggering enrichment only on net-new observables.

Integrations: Blink Case Management (native), CrowdStrike Falcon

Observable Enrichment

This use case encompasses the full library of enrichment subflows that look up IP addresses, domains, URLs, file hashes, usernames, and email addresses across the integrated threat intelligence and identity platforms.

Business problem solved: Manual enrichment of security observables is the most time-intensive step in alert triage. These subflows eliminate analyst lookup time by automatically querying every relevant platform the moment an observable is extracted from an incoming alert.

Integrations: CrowdStrike Falcon, VirusTotal, AbuseIPDB, URLScan, Microsoft Entra ID, Okta, Google Workspace, GitHub, Slack, Bash (whois/dig)

Workspace A

Workspace B

Case Management & SOAR

These playbooks manage the lifecycle of security cases — from initial notification through analyst assignment, status tracking, and automated closure — within the Blink native case management environment.

Business problem solved: Manual case lifecycle management creates delays between detection and analyst action and leaves audit trails incomplete. These playbooks ensure every case is acknowledged, assigned, and tracked to resolution without requiring analysts to perform repetitive administrative updates.

Integrations: Blink Case Management (native)

Incident Response Playbooks

Structured incident response playbooks that execute predefined remediation steps against triaged cases, with modular subflows for specific threat categories including phishing and malware.

Business problem solved: Without automated response playbooks, analyst response quality is inconsistent and dependent on individual experience. These playbooks enforce a repeatable, auditable response process for each incident category, reducing mean time to respond and ensuring no remediation steps are skipped.

Integrations: Microsoft Outlook (KnowBe4 phishing simulation check), Microsoft Entra ID, Blink Case Management

EDR Containment & Response

CrowdStrike Falcon-based endpoint containment playbooks that allow analysts to quarantine hosts and execute real-time response commands against individual endpoints or batches of hosts.

Business problem solved: Endpoint containment during an active incident requires immediate, repeatable action with a full audit trail. These playbooks let analysts trigger quarantine and remote response actions directly from the case management interface without switching to the CrowdStrike console.

Integrations: CrowdStrike Falcon RTR

Identity Threat Response

Playbooks that manage the lifecycle of risky user events surfaced by Microsoft Entra ID, enabling analysts to dismiss false positives or confirm a user as safe directly through the automation layer.

Business problem solved: Identity risk events in Entra ID require prompt analyst disposition to prevent alert fatigue and ensure genuine threats are escalated. These playbooks allow case-linked disposition of risky user signals without requiring direct Entra ID console access.

Integrations: Microsoft Entra ID (risky user APIs)

Threat Intelligence Curation

Automated ingestion of H-ISAC BlueIntel threat intelligence bulletins, enabling the security team to receive and act on sector-specific threat intelligence without manual monitoring of external feeds.

Business problem solved: Threat intelligence feeds deliver high-value context that often goes unread due to volume and the absence of workflow integration. This playbook ensures every H-ISAC bulletin is ingested, logged, and surfaced to the appropriate team automatically.

Integrations: Microsoft Outlook (email polling)

Deception Technology

End-to-end automation for Thinkst Canary deception alerts — from initial webhook ingestion through case creation to closed-loop analyst acknowledgement written back to the Canary platform.

Business problem solved: Canary alerts are high-confidence indicators of adversarial activity, but without automation they require manual triaging and acknowledgement steps that delay response. This use case ensures every Canary alert is immediately logged as a case and that analyst disposition is reflected back in the Canary console automatically.

Integrations: Thinkst Canary

Strengths

The agentic SOC pipeline is fully operational at production scale. Process Alert — the core orchestration engine — has processed 883 alerts end-to-end, handling observable extraction, case deduplication, enrichment routing, and downstream response actions without analyst intervention. This positions the automation program well beyond basic alert forwarding: it is executing structured, multi-step SOC workflows autonomously. Complementing this, the Thinkst Canary integration has delivered 193 total executions (180 ingestions, 13 closed-loop acknowledgements), representing one of the highest-confidence detection pipelines in the stack — every Canary alert is both actioned in case management and reconciled back to the source platform automatically.

The enrichment library is enterprise-grade in breadth. Forty-six enrichment subflows span IP reputation (VirusTotal, AbuseIPDB), domain and URL analysis (URLScan, Whois), file hash lookup (VirusTotal, CrowdStrike), and identity resolution across Microsoft Entra ID, Okta, Google Workspace, GitHub, and Slack. When Process Alert extracts an observable, the platform can query 10 distinct security data sources automatically. The H-ISAC BlueIntel integration (46 bulletins processed) adds sector-specific threat intelligence context to the operational picture, closing the loop between external threat feeds and the internal SOC workflow.

The case management layer is actively absorbing automation volume. Across the five active case management playbooks, 186 case lifecycle actions were executed — 62 analyst assignments, 41 status updates, 37 new case notifications, 25 automated closures, and 21 automated timeline comments. This represents meaningful SOC administrative overhead that has been eliminated from analyst workflows. The Generic IRP has also executed 54 times, confirming that structured incident response procedures are running against triaged cases.

Gaps and Opportunities

Three high-value response capability areas are deployed but show zero production executions: EDR containment (CrowdStrike host quarantine and RTR), identity threat response (Entra ID risky user disposition), and the phishing and malware response subflows. These represent the most operationally impactful automation available — endpoint quarantine and identity remediation are precisely the actions where automation reduces attacker dwell time most materially. Validating that the Generic IRP correctly routes to phishing and malware subflows via the Response Main Router should be a near-term priority; if the router is not selecting the correct subflow path, 54 IRP executions may be terminating at case documentation rather than executing remediation steps.

The enrichment subflows reporting zero direct executions is expected given their subflow architecture, but this creates a visibility gap: there is no straightforward way to confirm enrichment is firing correctly across the full observable type matrix (IP, URL, hash, username, domain) without instrumenting the Process Alert workflow directly. Adding lightweight execution logging or a metrics table update within the enrichment router would provide confirmation that the 46-subflow library is active against production alert volume.

Workspace B contains a near-complete mirror of the Workspace A enrichment and response subflow library — 16 enrichment playbooks plus response, error handling, and ingestion subflows — with zero executions across every playbook. If Workspace B is a staging or test environment, it should be explicitly documented as such. If it is intended as a production workspace for a distinct alert source or organizational unit, the ingestion playbooks that should be feeding it have not yet been connected. Resolving this ambiguity and either activating Workspace B's pipeline or consolidating it into Workspace A would simplify governance and eliminate the maintenance burden of keeping two parallel playbook libraries in sync.

Integration Ecosystem

The active integration footprint spans 12 or more platforms: CrowdStrike Falcon (EDR, hash enrichment, RTR), Rapid7 InsightIDR (SIEM), VirusTotal, AbuseIPDB, URLScan, Microsoft Entra ID (identity enrichment and risky user response), Microsoft Outlook (threat intel ingestion), Okta (identity enrichment), Google Workspace, GitHub, Slack, and Thinkst Canary. Four additional EXAMPLE ingest connectors — Microsoft Defender for Cloud Apps, Azure Monitor, AWS CloudTrail, and Wiz — have completed initial testing (8 combined executions) and are structurally ready to be promoted to production triggers. Activating these connectors would materially expand the alert surface covered by the automated pipeline without requiring new enrichment or response playbook development.