shelter-insurance — Customer Success Report

Total: 105 playbooks across 13 use cases

1. Email Threat Detection & Response

Category: SOC | Subcategories: Phishing detection & response, Case mgmt & SOAR

Description: Continuous automated processing of Proofpoint TAP email threat events — blocked URL clicks, permitted URL clicks, and delivered suspicious messages — with per-event alert creation, observable extraction, enrichment, and response routing. A rebuilt response router now drives Zscaler URL-blocking and human-in-the-loop Teams messaging directly from TAP alert context, replacing the earlier standalone response subflow.

Business problem: High-volume email threat telemetry from Proofpoint TAP cannot be manually triaged at scale. Automating ingestion-to-case across all three TAP event types, and closing the loop with automatic Zscaler blocking and analyst notification, ensures no threat goes unprocessed while reducing manual response steps.

Integrations: Proofpoint TAP, Zscaler ZIA, Google Chronicle, Microsoft Outlook, Microsoft Teams, Blink Case Management

2. Alert Triage & SOAR

Category: SOC | Subcategories: Case mgmt & SOAR

Description: End-to-end automated alert processing pipeline covering alert ingestion from case management polling and ServiceNow ITSM webhooks, observable extraction, deduplication into cases, and type-based response routing to specialized subflows. Includes Teams-based analyst notification and error handling for failed runs.

Business problem: Inconsistent manual triage leads to missed alerts, duplicate cases, and uneven analyst workloads. This pipeline standardizes alert handling from any source into a single, auditable processing flow with guaranteed routing and notification.

Integrations: Blink Case Management, ServiceNow, Microsoft Teams

3. Identity Threat Response

Category: SOC | Subcategories: Identity threat response

Description: On-demand identity containment for Microsoft Entra ID accounts — resets a user's password and revokes all active sessions in a single call, invoked as a response action from alert-handling workflows.

Business problem: When an account is suspected of compromise (e.g., from a phishing click or anomalous sign-in), every minute an attacker retains a valid session increases exposure. This closes the identity-response gap by giving responders a one-step containment action instead of manual, multi-console remediation in Entra ID.

Integrations: Microsoft Entra ID

4. IOC Enrichment & Observable Management

Category: SOC | Subcategories: Alert enrichment / IOC lookup, Case mgmt & SOAR

Description: A comprehensive multi-source enrichment framework that enriches observable types — IPs, URLs, hashes, usernames, email addresses — across VirusTotal, CrowdStrike, AbuseIPDB, URLScan, VMRay, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, and Whois. A central router dispatches observables to the appropriate enricher(s), with results written back to the case management platform via a shared enrichment update subflow.

Business problem: Manual enrichment across 10+ security tools consumes analyst time and introduces inconsistency. Automating observable enrichment at case creation time gives analysts pre-populated context on every alert, reducing mean time to investigate.

Integrations: VirusTotal, CrowdStrike, AbuseIPDB, URLScan, VMRay, Okta, Microsoft Entra ID, Google Workspace, GitHub, Slack, Whois/Dig, Blink Case Management

5. Endpoint Management & EDR Response

Category: SOC | Subcategories: EDR containment & response, Case mgmt & SOAR

Description: CrowdStrike-integrated endpoint response automation covering scheduled server decommission lifecycle management, real-time endpoint isolation and quarantine, RTR (Real Time Response) command execution to single hosts and host batches, device enrichment, and automated tagging of decommissioned assets. Two new subflows now handle CrowdStrike alert verification and device quarantine as discrete, callable response steps for the alert pipeline.

Business problem: Manual endpoint response to security incidents introduces dangerous delay. Automated CrowdStrike containment, RTR execution, and decommission processing reduces dwell time and ensures timely lifecycle management of retiring infrastructure.

Integrations: CrowdStrike, ServiceNow, Blink Case Management

6. Data Exposure & DLP Response

Category: GRC | Subcategories: DLP triage & exposure resp

Description: Integrates with Cyera (data security posture management) to flag a user's identity as high-risk when a data exposure or sensitive-data-handling signal is detected, creating an auditable risk marker for downstream monitoring.

Business problem: Data exposure risk tied to specific identities is easy to lose track of without a systematic flagging step. Automating the "mark as risky" action ensures every Cyera-detected exposure signal produces a consistent, auditable identity risk designation rather than a one-off manual note.

Integrations: Cyera

7. Zscaler Web Policy & DLP Management

Category: Cloud Security | Subcategories: Cloud access & SaaS policy mgmt, SIEM & log pipeline monitoring

Description: Automated management of Zscaler Internet Access web filtering policies, including scheduled expiry cleanup of stale URL rules, webhook-triggered alert processing for policy violations, and dynamic rule creation for cloud file-sharing services (Dropbox, ShareFile, Google Drive). Google Chronicle integration provides SIEM-backed investigation links for Zscaler events.

Business problem: Stale Zscaler URL rules accumulate without automation, creating policy drift and potential security gaps. Automated enforcement of cloud app access policies (especially for file-sharing services that create DLP risk) reduces data exfiltration exposure.

Integrations: Zscaler ZIA, Google Chronicle, Proofpoint TAP

8. ServiceNow ITSM & On-Call Management

Category: Other | Subcategories: IT helpdesk & ticket routing

Description: Bidirectional ServiceNow integration for security operations workflow management. Covers automated processing of employee travel requests for security review and dynamic on-call schedule resolution from ServiceNow and SharePoint, plus two developer test workflows validating ServiceNow custom actions.

Business problem: Security teams need timely awareness of employee travel (for geolocation anomaly context) and a resolvable on-call chain without manually monitoring multiple systems.

Integrations: ServiceNow, SharePoint, Microsoft Entra ID

9. Phishing Simulation & Security Awareness

Category: SOC | Subcategories: Phishing sim & awareness

Description: Full Proofpoint Security Awareness Training phishing simulation tracking pipeline, including campaign result ingestion, data storage in Blink tables, and Microsoft Entra ID enrichment of user records. A webform-based onboarding flow and Teams-interactive training workflow provide self-service security awareness tooling. Currently built and staged but not yet producing executions at scale.

Business problem: Security awareness programs require automated data collection to measure campaign effectiveness and identify high-risk users who repeatedly fail simulations — informing targeted remediation and training prioritization.

Integrations: Proofpoint Security Awareness Training, Microsoft Entra ID, Microsoft Teams, ServiceNow, Blink Tables

10. Threat Intelligence Ingest

Category: SOC | Subcategories: Threat intel ingest & curation, SIEM & log pipeline monitoring

Description: Automated daily ingestion of threat intelligence and breach-monitoring content from RSS feeds — including HackerNews, Bleeping Computer, Dark Reading, Security Weekly, KrebsOnSecurity, HaveIBeenPwned, and Wired — merged and stored in a shared table for SOC consumption. Chronicle log ingestion testing supports SIEM pipeline validation for Zscaler log data via Cyderes-managed Chronicle.

Business problem: SOC teams need a continuous, automated stream of external threat and breach intelligence to stay current on emerging threats without manually monitoring multiple feeds.

Integrations: RSS (HTTP), Google Chronicle (Cyderes), Blink Tables

11. Case Management Utilities, Recovery & Testing

Category: SOC | Subcategories: Case mgmt & SOAR

Description: Supporting infrastructure for the SOAR platform including observable relation management (create, update, delete), case similarity detection, stale case closure, unprocessed alert recovery, and observable extraction template validation. Also includes alert-simulation tools used to generate synthetic CrowdStrike, ProofPoint, and Okta alerts for pipeline testing, plus a Teams message-format test.

Business problem: These utilities underpin the health and accuracy of the case management platform and let the team validate the alert pipeline with synthetic data, without representing direct analyst-facing outcomes themselves.

Integrations: Blink Case Management, Microsoft Teams

12. Agentic SOC

Category: SOC | Subcategories: Agentic SOC, Alert enrichment / IOC lookup

Description: An AI agent-powered user investigation capability that invokes a named Blink Agent to answer questions about user identities and activity. Represents early-stage deployment of agentic automation for SOC analyst augmentation.

Business problem: Complex investigation questions that span multiple data sources traditionally require significant analyst effort. Agentic automation can handle routine lookup and correlation tasks autonomously, freeing analysts for higher-order decisions.

Integrations: Blink Agents (AI)

13. Platform Onboarding & Testing Utilities

Category: Other | Subcategories: SaaS / IT administration

Description: Blink platform onboarding templates ("Hello World") and lightweight subflow-chaining/timing test workflows, spread across three separate workspaces. These validate platform mechanics (bash/python execution, subflow chaining, sleep timing) rather than delivering a security outcome.

Business problem: Not applicable — these are platform enablement and internal testing artifacts, included here for completeness of the full automation inventory rather than as a business-driven use case.

Integrations: None (native Blink platform actions only)

Strengths

Mature email threat pipeline, now with closed-loop response. The Proofpoint TAP ingestion suite remains the highest-volume automation in the environment, processing over 24,000 events in 12 months. Since the last review, the response side matured too: a rebuilt Subflow - Response Router - ProofPoint TAP now drives Zscaler URL blocking and human-in-the-loop Teams messaging directly (39 executions), replacing the earlier standalone response subflow that has since gone dormant.

Identity threat response is now live. The previous report flagged automated identity containment as a gap. That gap is now closing: Subflow - Response - Reset User Password and Revoke Sessions - Microsoft Entra ID has executed 7 times, giving responders a one-step password reset + session revocation action instead of manual, multi-console remediation.

New DLP/data-exposure integration (Cyera). Cyera - Mark User as Risky (23 executions) is a new capability that automatically flags identities associated with data exposure signals from Cyera's data security posture management platform — extending the automation footprint beyond email/endpoint/identity into data risk.

CrowdStrike remains the anchor EDR platform, with 960 automated server decommission checks and now two additional response subflows (alert verification and device quarantine) built to formalize CrowdStrike alert response as discrete, reusable steps.

Comprehensive enrichment library. The IOC enrichment framework covers 10+ intelligence sources with a central observable router (98 invocations) and shared enrichment update subflow, scaling cleanly as new sources are added.

Growing ServiceNow adoption. Travel request processing grew from 51 to 80 executions (+57%), and the on-call dispatcher lookup grew from 18 to 38 executions, indicating increasing reliance on these workflows for day-to-day security operations.

Gaps & Opportunities

Google Chronicle Zscaler Search has gone idle. This workflow ran 9 times in the previous reporting period and shows 0 executions now, while a related but differently-named workflow (Subflow - Response - URL Traffic Verification - Google Chronicle) picked up 7 executions. Worth confirming whether Chronicle-backed investigation moved fully to the new subflow or whether the standalone search tool was simply not needed this period.

Zscaler webhook alert volume dropped sharply (26 → 12 executions), while Zscaler Expired rules and Zscaler Rules for Dropbox, Sharefile, Gdrive both grew. Worth confirming this reflects fewer actual policy violations rather than a webhook delivery issue.

Workspace sprawl and test/demo clutter is increasing. The environment now spans 4 workspaces (up from 1), and roughly 10 of the 105 playbooks are explicitly named as tests, demos, or "copy" duplicates (SNOW TEST, testing grounds, Test Reset, Test Email Format, Simulate Crowdstrike Alert, Simulate Multiple Alerts from Different Sources, Getting Started - Hello World, Self-service Demo, Flow Completion Test, Subflow 1/2 - seconds, plus Phishing Simulation Tracking - Adam Testing Copy and its related "copy" subflows). None have executed. A cleanup pass would sharpen the signal in future reporting.

Phishing simulation tracking is still built but inactive. The Proofpoint Security Awareness Training integration has zero executions, unchanged from last period. Activating it would close the loop between email threat detection (already running at scale) and the training program.

Enrichment pipeline utilization is low relative to its breadth. Despite 98 router invocations, most individual enrichment playbooks show 0 executions; only hash/URL enrichers show single-digit activity. Confirming end-to-end wiring from alert triage into these enrichers would surface value from the existing library.

Agentic SOC is still a single pilot. Agent Get User Info has 0 executions. As Blink's agent platform matures, expanding into multi-step investigation patterns would be a natural next step given the existing enrichment and SOAR foundation.

Integration Ecosystem