rockwell-c-i-training — Customer Success Report

Total: 87 playbook instances across 9 workspaces (several Cisco POC workflows are duplicated across training workspaces)

1. Agentic SOC — Alert Triage & Response Pipeline

Description: A full end-to-end automated SOC pipeline that ingests incoming alerts on a 1-minute polling interval, extracts and deduplicates observables, enriches indicators, routes cases to type-specific response subflows (phishing, malware), and manages case lifecycle. Built entirely on Blink's native case management.

Business problem solved: Eliminates manual alert triage and first-responder investigation. Analysts work pre-enriched, deduplicated cases rather than raw alerts — reducing mean time to respond and analyst fatigue across high-volume environments.

Category: SOC | Subcategories: Agentic SOC, Case mgmt & SOAR, Phishing detection & response, EDR containment & response

Integrations: CrowdStrike, Microsoft Outlook, Blink Case Management, Email (core)

2. Alert Enrichment & IOC Lookup

Description: A comprehensive library of enrichment subflows automatically invoked by the SOC pipeline for every observable extracted from an incoming alert. Covers all major IOC types — IPs, hashes, URLs, usernames, email addresses, and domain names — across the full security toolstack.

Business problem solved: Replaces manual analyst lookups across 8+ security tools. Every indicator is enriched before an analyst touches a case, providing context at the moment it is needed.

Category: SOC | Subcategories: Alert enrichment / IOC lookup

Integrations: CrowdStrike, VirusTotal, URLScan, AbuseIPDB, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack

3. On-Demand Investigation Tools

Description: A library of standalone analyst-facing investigation workflows invokable on-demand for ad-hoc lookups — user identities, threat intelligence, DNS/WHOIS, URL screenshots, and product end-of-life dates. Designed for analyst investigations independent of the automated alert pipeline.

Business problem solved: Gives SOC analysts single-click access to multi-source enrichment without requiring direct tool access, stored credentials, or manual API calls.

Category: SOC | Subcategories: Alert enrichment / IOC lookup, Identity threat response

Integrations: Google Workspace, GitHub, Microsoft Entra ID, Okta, CrowdStrike, VirusTotal, Slack, URLScan, HTTP APIs, Bash/DNS

4. EDR Containment & Remote Response

Description: CrowdStrike-based endpoint containment and Real-Time Response (RTR) workflows enabling isolation of compromised hosts and execution of remote commands — on a single endpoint or across a batch — directly from Blink.

Business problem solved: Reduces time-to-containment on endpoint threats. Analysts quarantine devices or run remediation commands without switching tools or logging into CrowdStrike directly.

Category: SOC | Subcategories: EDR containment & response

Integrations: CrowdStrike

5. Case Management Utilities

Description: Utility workflows for managing the observable relationship graph within Blink's case management system — listing, creating, updating, and deleting observable-to-alert links, and finding similar open cases based on shared indicators.

Business problem solved: Maintains case data integrity and surfaces related investigations automatically, reducing analyst correlation effort and duplicate case creation.

Category: SOC | Subcategories: Case mgmt & SOAR

Integrations: Blink Case Management

6. IT/OT Network Infrastructure Automation

Description: POC and working automations targeting Rockwell's OT/network infrastructure stack. Covers Cisco switch SmartNet coverage validation (marked POC COMPLETE), switch health checks via Ansible, SSH-based switch command execution, and Sumo Logic insight processing. These automations are deployed across multiple training workspaces, indicating active iteration by multiple engineering teams.

Business problem solved: Automates manual network operations tasks — warranty/support coverage checks, switch health monitoring, and SIEM log review — reducing manual effort for network engineers managing industrial OT environments.

Category: Other | Subcategories: IT/OT & network infra monitoring

*Note: Cisco SmartNet Coverage and Cisco Switch Health Check each appear in 5 training workspaces; Sumo Logic Collectors appears in 2. Links point to the primary workspace instance.*

Integrations: Cisco API, Ansible, SSH, Sumo Logic, N-Able N-Central, Bash

7. VM Disk Capacity Management

Description: An approval-gated workflow that checks current VMware vSphere disk capacity, presents findings to an approver via Microsoft Teams, and expands disk size only after explicit change approval. Human-in-the-loop by design.

Business problem solved: Automates disk expansion requests with a governed approval process, removing manual back-and-forth between requestors, infrastructure engineers, and change management.

Category: Other | Subcategories: DevOps & release automation

*Note: Also deployed in workspaces 978e9c6d and d4059f53.*

Integrations: VMware vSphere, Microsoft Teams

8. Scheduled Alerting & Notifications

Description: A scheduled automation running every 5 minutes that polls a weather alert API and conditionally delivers customer notifications when active alerts are detected. The only automation in the environment with significant production execution volume.

Business problem solved: Ensures timely weather alert notifications without manual monitoring — relevant to Rockwell's field operations and customer-facing service delivery in environments where weather conditions affect industrial operations.

Category: Other | Subcategories: IT helpdesk & ticket routing

Integrations: HTTP API (weather service), Blink default API

9. AI-Augmented Workflow Automation

Description: A set of LLM-powered workflows integrating with an internal Azure OpenAI endpoint for intelligent request handling, ticket triage, and automated response generation. Includes a web-form-driven email simulation pipeline that classifies inbound tickets via OpenAI and routes responses through Microsoft Teams, as well as a drive intake process and server pre-check automation.

Business problem solved: Augments human decision-making with AI-generated analysis and routing, reducing time spent on routine classification tasks. The LLM request framework (RA-LLM Request) provides a reusable AI invocation pattern for downstream automations.

Category: Other | Subcategories: IT helpdesk & ticket routing, SaaS / IT administration

Integrations: Azure OpenAI, Microsoft Teams, Blink Tables, Web Forms, Email

10. Training & Platform Familiarization

Description: A collection of "hello world" style workflows, web form exercises, subflow training, and hands-on training scenarios spread across multiple isolated training workspaces. Each workspace represents a distinct training cohort or session for Rockwell's teams learning Blink's core capabilities.

Business problem solved: Provides safe, isolated environments for teams to learn automation logic, web forms, subflows, and integrations without impacting production systems.

Category: Other | Subcategories: SaaS / IT administration

Integrations: Various (training exercises across all major Blink capabilities)

11. Employee Offboarding Intake

Description: A public-facing web form allowing HR/IT to initiate employee offboarding by submitting the company name and employee email, paired with a supporting subflow that reformats usernames for downstream identity system lookups.

Business problem solved: Provides a self-service entry point for kicking off employee offboarding, standardizing the request format before it reaches identity/directory systems and reducing manual ticket creation.

Category: IAM | Subcategories: Employee offboarding

Integrations: Blink Web Form (internal)

Strengths

1. Production-ready SOC automation stack. The main SOC workspace (076024e1) contains a sophisticated agentic SOC pipeline — event-driven alert ingestion, observable extraction and deduplication, multi-source enrichment, type-specific response subflows, and case lifecycle management. This is a complete blueprint for enterprise SOC automation at scale.

2. Exceptional enrichment coverage. The enrichment library spans 9 distinct integrations and every major observable type an enterprise SOC analyst would encounter: IPs (VirusTotal, AbuseIPDB), hashes (VirusTotal, CrowdStrike), URLs (VirusTotal, URLScan), usernames/emails (Okta, Entra ID, Google Workspace, GitHub, Slack), domains (WHOIS). Few environments achieve this breadth.

3. Active production automation. The Customer Weather Alert Notification workflow executed 11,552 times over the past 12 months — demonstrating consistent operational automation delivery on a non-security use case, and confirming the environment can sustain production-grade scheduled workloads.

4. IT/OT automation investment. The Cisco SmartNet Coverage workflow (marked POC COMPLETE) and the Cisco Switch Health Check (POC Draft) demonstrate active exploration of OT/network infrastructure automation — a high-value area given Rockwell's industrial automation domain. The Ansible-based health check in particular shows ambition to automate complex multi-step network operations.

5. AI integration actively explored. Multiple workspaces contain LLM-powered workflows using Azure OpenAI. The RA-LLM Request pattern is cleanly abstracted as a reusable subflow, showing architectural maturity in how AI is being incorporated.

6. Structured enablement program. Eight distinct training workspaces, each containing exercises and hands-on scenarios, indicate a formal and repeating Blink onboarding program — a strong signal of organizational adoption depth.

Gaps

1. SOC pipeline not yet receiving live alert volume. Despite a complete and validated SOC automation stack, only 1 alert was processed through Process Alert in the last 12 months. All enrichment subflows show 0 executions, indicating the pipeline has been built and demonstrated but is not yet connected to a live alert source (e.g., CrowdStrike, Proofpoint).

2. EDR containment not activated. The CrowdStrike RTR and host quarantine workflows exist but have never executed. Containment actions remain manual, which is the highest-impact gap in a mature SOC program.

3. IT/OT workflows in POC state. The Cisco SmartNet and Switch Health Check automations are validated but deployed only in training workspaces. Production promotion — connecting to live Cisco infrastructure — would immediately deliver operational value.

4. AI workflows not yet in production. All LLM-powered workflows have 0 executions. The Azure OpenAI integration is configured and the workflow architecture is solid; the gap is connecting to live ticket or alert feeds.

Integration Ecosystem