oxford — Customer Success Report

1. SOC Threat Detection & IOC Processing

Description: Fully automated threat detection and IOC investigation pipeline running at a 5-minute polling cadence across SentinelOne EDR and Expel MDR. Each threat event and IOC is automatically fetched, evaluated, and routed without analyst involvement in the initial triage layer. A daily health check validates that both integrations are operating correctly.

Business problem: Alert volume exceeds human capacity to triage manually. A continuous polling automation layer ensures no event is missed and response begins immediately — at a volume that would be operationally impossible to handle manually.

Integrations: SentinelOne, Expel, PowerShell

2. Employee Offboarding — Full Lifecycle

Description: End-to-end employee and contractor offboarding spanning identity deprovisioning in Microsoft Entra ID and Active Directory, plus access revocation across 7 business applications (Celigo, Matillion, DataDog, Looker, Manhattan Active Omni, Manhattan Active Warehouse Management, Delinea PAM). Triggered by automated HR feeds from Workday (via Snowflake) and Ranger API on daily schedules, plus a manual web-form pathway for ad-hoc cases. All offboarding actions are tracked with Jira comments for audit. A full dev workspace mirrors the production stack for continuous iteration.

Business problem: Manual offboarding across 8+ systems takes hours per leaver and creates identity sprawl and access risk. Automation ensures access is revoked consistently and immediately from every system — with Jira ticketing as the audit trail.

Integrations: Microsoft Entra ID, Active Directory (WinRM), Snowflake, Ranger API, ServiceNow, Jira, Celigo, Matillion, DataDog, Looker, Manhattan Active Omni, Manhattan Active Warehouse Management, Delinea, Python, PowerShell

Production Workspace

Development Workspace

3. Temporary Workforce Lifecycle (Joiner & Leaver)

Description: Automated lifecycle management for temporary warehouse staff, provisioning accounts every 3 hours via the Ranger workforce API and deprovisioning on a daily schedule. A full-employee joiner flow (covering Entra ID account creation with Python normalization and OU mapping) exists in the development workspace with early executions.

Business problem: Temporary workforce turnover is high and constant. Manual account management at this volume creates orphaned accounts and access risk; automation eliminates both and ensures shift-ready access at all times.

Integrations: Ranger API, Microsoft Entra ID, Active Directory (WinRM), Python, PowerShell

4. Identity Lifecycle & Health Monitoring

Description: Supporting playbooks that maintain data integrity and operational health across the IAM pipeline. Covers daily user metadata sync from Snowflake, directory hygiene checks (litigation hold status, disabled-account cleanup), weekly tracking of high-value target employees and their direct reports, self-service account unlock, and scheduled health checks that validate termination processing is functioning correctly end-to-end.

Business problem: IAM automation is only reliable if its underlying data is current and its execution is verified. These playbooks provide the observability and data hygiene layer that makes the broader offboarding pipeline trustworthy.

Integrations: Snowflake, Microsoft Entra ID, Exchange Online, PowerShell, Blink Tables

5. Cloud Access & Entra Governance

Description: Two targeted governance automations for Microsoft Entra ID: a credential expiry monitor that checks enterprise application certificate and secret expiry on a rolling schedule (preventing service outages from lapsed credentials), and a weekly policy enforcement run that reviews non-exempt mobile access for warehouse workers.

Business problem: Expired app credentials cause production outages; unchecked mobile access creates compliance gaps. Both require regular detection that is impractical to run manually at scale.

Integrations: Microsoft Entra ID, Snowflake

6. IT Service Request Automation

Description: Hourly processing of application access requests submitted through ServiceNow. Polls for open records, iterates over them, and processes each request — eliminating manual IT queue management for a high-volume, recurring request type.

Business problem: Application access requests accumulate in the ServiceNow queue and require constant manual review. Hourly automation processes them without IT intervention, reducing fulfillment time from hours to minutes.

Integrations: ServiceNow

7. Connection Health Monitoring

Description: Daily validation that all critical integration endpoints — Ranger API, Active Directory (OXM), and Microsoft Entra ID — are reachable and returning expected responses. Provides an early-warning signal for integration failures before they cause silent automation breakdowns downstream.

Business problem: Broken connections cause automation failures that are invisible until an offboarding or provisioning event fails mid-execution. A daily health check surfaces issues proactively.

Integrations: Ranger API, Active Directory (WinRM/ADOP), Microsoft Entra ID

8. Retail Workforce Training Provisioning

Description: Daily overnight sync of retail employee training data from Snowflake, automating access provisioning for a retail brand subsidiary. Runs at 00:45 UTC to ensure records are current at the start of each business day.

Business problem: Retail training access for a subsidiary brand requires daily reconciliation between HR data (Snowflake) and access systems, a task that is repetitive and operationally low-value when performed manually.

Integrations: Snowflake

9. Employee Onboarding — Full Lifecycle

Description: End-to-end joiner automation now live in production, spanning Ranger contractor sourcing (hourly polling plus on-prem/cloud account creation and password generation), Workday/Snowflake new-hire intake, and a dual-brand (Oxford / Tommy Bahama) full-employee joiner with Active Directory/Entra ID provisioning, OU mapping, and Jira-tracked fulfillment. Data reconciliation utilities (Employee Lookup, Backfill variants) support historical and ad-hoc hire record correction, and a web-form intake pathway exists in development for manual ad-hoc joiner requests.

Business problem: Onboarding previously lacked a production pathway for full employees and Ranger-sourced contractors, creating delays and inconsistent day-one access across two brands and multiple hiring sources (Workday, Ranger). This pipeline automates account creation, password generation, OU placement, and Jira-tracked fulfillment consistently across both brands and sourcing systems.

Integrations: Microsoft Entra ID, Active Directory (WinRM), Snowflake, Ranger API, Jira, Blink Tables, Python, PowerShell

Production Workspace

Development Workspace

Strengths

• High-volume SOC automation at scale: The SentinelOne + Expel pipeline processes ~23,000 events per year on a 5-minute polling interval. This represents the highest-volume use case by a wide margin and eliminates what would otherwise be thousands of manual alert-triage decisions annually.
• Deep, multi-system offboarding pipeline: Employee offboarding spans 8 systems including Delinea PAM for privileged account revocation, two Manhattan supply chain platforms, and core enterprise tools (Celigo, Matillion, DataDog, Looker). The combination of automated HR triggers (Workday via Snowflake, Ranger API) and a manual web-form pathway for ad-hoc cases ensures complete coverage across all departure types.
• Data-first IAM architecture: Snowflake serves as the authoritative data layer for user metadata sync, termination detection, and high-value target tracking — making the IAM pipeline data-driven rather than solely event-driven.
• Operational resilience built in: Daily connection health checks and IAM health check playbooks indicate a mature approach to automation monitoring and failure detection rather than reactive debugging.
• Full employee onboarding now in production: The previously dev-only joiner gap has closed. A new production pipeline provisions accounts for both Oxford and Tommy Bahama brands, syncs Ranger contractor and Workday new-hire identities (1,986 executions), and drives Jira-tracked, OU-mapped Active Directory/Entra ID provisioning — delivering the symmetric onboarding/offboarding coverage previously missing.

Gaps / Opportunities

• Onboarding pipeline has duplicate/near-duplicate utilities: Four zero-execution backfill playbooks (Backfill, Backfills, BackfillNewHire, BackfillNewHIres) perform overlapping Snowflake reconciliation logic. Consolidating these would reduce clutter as the new onboarding pipeline matures.
• Vulnerability management is inactive: Rapid7 is integrated and a playbook exists in the production workspace, but it has 0 executions. The integration is deployed but no active automation is driving it.
• No GRC or compliance automation: There is no coverage for compliance monitoring, DLP, audit reporting, RBAC access review/certification, or regulatory controls. Given the depth of IAM investment, automated access certification campaigns are a natural next step.
• Cloud security scope is narrow: Entra credential monitoring and mobile access policy enforcement cover a small slice of cloud governance. No CSPM, cloud asset inventory, or broader configuration audit automation is present.
• 5 sandbox/test playbooks with 0 executions exist across three separate test workspaces (New Workflow, New Workflow 1, Sub Workflow, Parent Workflow, Workflow Version History Test) — these can be cleaned up to reduce workspace clutter.

Integration Ecosystem