rockwell_c-i-production-eu — Customer Success Report

1. OT Alert Triage & Lifecycle Management

Category: SOC

Subcategories: Case mgmt & SOAR, Alert enrichment / IOC lookup

Description: Automated lifecycle management of OT/ICS security alerts generated by Claroty CTD across distributed industrial sites — including scheduled batch archival of aged alerts, per-run resolution of acknowledged findings, bidirectional closure linked to Sumo Logic insight status, and monthly alert count reporting per site. Designed to operate across three parallel Blink workspaces serving different site groups.

Business Problem: Claroty CTD generates continuous, high-volume alert streams across OT environments. Without automation, SOC analysts must manually review, archive, and close alerts that are aged, duplicated, or already remediated — creating backlogs that mask genuine threats and slow mean-time-to-resolve.

Integrations: Claroty CTD, Sumo Logic (for insight-correlated closures), Microsoft Teams (error escalation)

2. OT Asset Inventory & Security Metrics

Category: Other

Subcategories: IT/OT & network infra monitoring

Description: Automated collection and forwarding of OT asset data from Claroty CTD and XDome to Sumo Logic — covering assets with active security insights, devices operating on unsecured protocols against baseline, per-site firmware versions, and IoT/OT device records related to active alerts. Runs on monthly schedules and event triggers, pushing structured data to the SIEM for centralized analysis and reporting.

Business Problem: Maintaining an accurate, up-to-date OT asset inventory across geographically distributed industrial sites requires pulling from multiple security tools. Without automation, asset data becomes stale between collection cycles, unsecured protocol deviations go unreported, and site firmware posture is unknown — creating persistent blind spots in the organization's OT security picture.

Integrations: Claroty CTD, XDome, Sumo Logic, Microsoft Teams

3. SIEM Alert Monitoring & SOC Escalation

Category: SOC

Subcategories: SIEM & log pipeline monitoring, Agentic SOC

Description: Continuous, every-2-minute polling of Sumo Logic for unacknowledged security insights, with automated Microsoft Teams notifications pushed to SOC analysts ensuring timely acknowledgement. Complemented by event-driven SIEM enrichment (triggered on new/updated insights via Sumo Logic webhook) and automated insight closure when investigations conclude.

Business Problem: In high-volume SOC environments, unacknowledged SIEM alerts accumulate silently. Without automated follow-up, analysts have no persistent signal that open insights require action, leading to increased MTTA and potential missed detections. This automation enforces analyst accountability at machine speed.

Integrations: Sumo Logic, Microsoft Teams

4. ITSM Case & Incident Automation

Category: SOC

Subcategories: Case mgmt & SOAR

Description: Event-driven creation of ServiceNow security cases and health incidents triggered from Sumo Logic and OT monitoring events. Also includes bidirectional Oracle ticket management — automating ticket creation from SIEM insight escalations and closing tickets when Sumo Logic insights resolve. Ensures every security and health event generates a properly structured, audit-ready ITSM record.

Business Problem: Manual ITSM ticket creation for security events introduces delays between detection and documentation, risks inconsistent data entry, and removes traceability. Automated case creation ensures immediate, structured ticket filing without analyst overhead, supporting SLA compliance and incident audit trails.

Integrations: ServiceNow, Oracle, Sumo Logic

5. Operational Notification Infrastructure

Category: Other

Subcategories: SaaS / IT administration

Description: Cross-cutting utility playbooks that provide error escalation via Microsoft Teams for every automation domain above — Claroty CTD operations, Sumo Logic flows, and XDome workflows each have a dedicated Teams error subflow. Executions of these playbooks reflect error handling overhead rather than primary business outcomes. Also includes a one-time Getting Started test workflow.

Note: The SubFlow - Send Error Message Via Teams SumoLogic recorded 15,073 executions in the bb1daa88 workspace — nearly matching the execution volume of the Sumo Logic Unacknowledged Insights notification scheduler (15,075). This 1:1 ratio suggests the primary Sumo Logic workflow was consistently encountering an error condition on almost every run during part of the year, warranting investigation.

Strengths

Specialized OT security automation is the core differentiator. The dominant workload is OT/ICS-specific — Claroty CTD and XDome cover the industrial security layer while Sumo Logic serves as the SIEM aggregation point. This is a rare, mature automation pattern that directly addresses Rockwell's industrial cybersecurity mandate. The pipeline from OT sensor → Blink → SIEM → ITSM is fully wired.

Multi-workspace SOC hierarchy demonstrates operational maturity. Playbooks run across three distinct workspaces — one primary (bb1daa88) and two SOC-Parent environments (16512276, b780643a) — indicating a deliberate multi-site or multi-team operational design. The SOC-Parent workspaces together account for the majority of active executions, suggesting these are the live production environments.

Sumo Logic oversight automation runs continuously at scale. The unacknowledged insights notification cron (every 2 minutes, across 3 workspaces) logged 48,372 combined runs. This represents persistent, machine-enforced analyst accountability — every open SIEM alert has a defined follow-up cadence without manual process overhead.

Claroty CTD alert resolution is highly active. SubFlow Claroty CTD Resolve Alert recorded 1,343 combined executions (326 in workspace 16512276, 1,017 in b780643a) — the highest volume of any direct operational action, reflecting automated OT alert closure as the primary SOC activity.

Gaps & Risks

Sumo Logic error rate in primary workspace warrants investigation. SubFlow - Send Error Message Via Teams SumoLogic executed 15,073 times in workspace bb1daa88 — a near 1:1 ratio with the Sumo Logic Unacknowledged Insights notification scheduler in the same workspace (15,075). This strongly suggests the workflow was failing on nearly every run for an extended period. The SOC-Parent workspaces show much lower error rates (6 and 15 respectively), suggesting those environments operate more cleanly.

Oracle integration is built but has zero production executions. The full Oracle ticket automation (Sumo Logic Create Oracle Ticket + Oracle Get Incident and Close) across all three workspaces shows 0 executions. This path appears to be a configured but untriggered integration — either the trigger condition is never met or the integration was superseded by the SNOW workflow.

SIEM enrichment automation is significantly underutilized. Sumo Logic SIEM Enrichment Automation recorded only 8 total executions across active workspaces despite being a webhook-triggered event automation. This likely means the Sumo Logic enrichment webhook is either not configured to fire broadly, or insights are reaching closure without triggering the enrichment path — a potential coverage gap in alert context.

XDome automation is nascent. XDome Get Devices (1 execution), XDome Get Devices Related to Alerts (1 execution), and XDome Execution Scheduler (1 execution) show near-zero activity. XDome alert closure subflows have 0 executions across all workspaces. The integration exists but has not been operationalized at scale — representing an opportunity to extend coverage to the IoT/OT device layer.

Several "5.0" variant playbooks overlap with existing production flows. A set of "5.0"-suffixed playbooks (Claroty_CTD_Execute_Site_Metrics_Assets 5.0, Claroty CTD - Get Alert Count 5.0, etc.) coexist with their non-5.0 counterparts. Both versions appear active in some workspaces. Without clear versioning governance, this risks duplicate data collection, inconsistent behavior across sites, and compounding maintenance overhead.

Integration Ecosystem