snyk — Customer Success Report

1. Agentic SOC & Automated Alert Response

Description: Fully automated security operations center pipeline — ingests alerts from Panther via webhook, extracts and deduplicates observables, orchestrates enrichment, routes to response playbooks based on alert type, and syncs closed cases back to the SIEM. Includes AI-assisted backlog analysis and daily ops metrics reporting.

Business Problem: Analyst capacity is the binding constraint in any SOC. This platform eliminates manual alert triage, deduplication, and initial enrichment — freeing analysts for high-judgment decisions while ensuring consistent handling of every alert at machine speed.

Category: SOC

Subcategories: Agentic SOC, Case mgmt & SOAR

Integrations: Panther, Microsoft Outlook, Slack, Jira, CrowdStrike, Gemini, Google Docs, Google Sheets, Blink Case Management

2. Alert Enrichment & IOC Lookup

Description: A comprehensive library of enrichment playbooks covering every major observable type — IPs, domains, hashes, URLs, usernames, and email addresses — queried across threat intel platforms and enterprise identity sources. All playbooks feed context back into the Blink case management platform via the Subflow - Update Enrichment Data pipeline.

Business Problem: Manual IOC lookup across 8+ tools is a time-consuming, error-prone step that slows analyst response. This library standardizes enrichment into reusable building blocks that run automatically when the Process Alert flow triggers observable extraction.

Category: SOC

Subcategories: Alert enrichment / IOC lookup

Integrations: VirusTotal, URLScan, AbuseIPDB, CrowdStrike, Okta, Google Workspace, Microsoft Entra ID, GitHub, Slack, Whois, Blink Case Management, Blink Tables

3. EDR Containment & Response

Description: On-demand playbooks to isolate compromised endpoints and execute remote response actions via CrowdStrike Real-Time Response (RTR) — targeting either a single host or a batch of devices simultaneously.

Business Problem: When a malware or intrusion alert fires, minutes matter. This suite enables analysts to quarantine a device or run forensic commands directly from the SOC workflow without switching tools or manually identifying the host.

Category: SOC

Subcategories: EDR containment & response

Integrations: CrowdStrike

4. Identity Threat Response & User Containment

Description: End-to-end orchestration for responding to compromised or risky user accounts. Includes human-in-the-loop Slack approval workflows that allow analysts to select containment actions (revoke sessions, lock device, reset password) across Okta, Google Workspace, Slack, Salesforce, and JAMF — all triggered from a single entry point. Also covers proactive insider threat monitoring, risky user sweeps, and admin user enrichment via Panther/Snowflake.

Business Problem: Containing a compromised account requires coordinated action across 5+ enterprise tools. Without automation, an analyst manually revokes sessions across each system sequentially, often taking 30+ minutes. This suite reduces mean time to contain (MTTC) to under two minutes while maintaining an auditable approval trail.

Category: SOC / IAM

Subcategories: Identity threat response, Password & credential lifecycle, Identity lifecycle automation

Integrations: Okta, Google Workspace, Google Admin Console, Slack, Salesforce, JAMF, Panther, Snowflake, Blink Tables

5. SIEM & Audit Log Ingestion

Description: Scheduled daily pipelines that pull audit logs from five security tooling sources and archive them to AWS S3, feeding a centralized data lake for correlation and compliance. Covers Terraform HCP, FireHydrant incident management, GitGuardian secrets detection, and the Blink platform itself, with AWS Glue pipeline health monitoring.

Business Problem: Maintaining continuous, tamper-evident audit trails across security tooling is required for compliance and forensic readiness. Manual log pulls are unreliable and error-prone. These pipelines ensure each source is archived daily without analyst involvement.

Category: SOC

Subcategories: SIEM & log pipeline monitoring

Integrations: Terraform HCP, FireHydrant, GitGuardian, Blink (audit logs), AWS S3, AWS Glue, Panther

6. Cloud Security & Network Posture

Description: Monitors Orca Security cloud posture notifications daily, tracks Zscaler device enrollment and CIDR ranges, and automates Terraform Cloud plan activation via webhook. Includes Zscaler-to-Snowflake data sync with Slack notification, device statistics calculation, and bulk user communication for Zscaler onboarding campaigns.

Business Problem: Cloud security posture and network access policy drift are hard to detect manually at scale. This suite surfaces Orca findings daily, keeps Zscaler device data synchronized with the data warehouse, and ensures Terraform-managed network changes activate automatically.

Category: Cloud Security

Subcategories: CSPM ingest & triage, Cloud provisioning & IaC automation, Cloud asset coverage & inventory

Integrations: Orca Security, Zscaler, AWS S3, Snowflake, Slack, JAMF, Terraform Cloud, Google Sheets, Salesforce

7. IT Asset Management (ITAM)

Description: Automated asset inventory management pipeline that pulls data from CrowdStrike, JAMF, and Jira weekly to build a comprehensive user-device database, uploads it to S3, and keeps CrowdStrike device tags synchronized with ITAM classifications. Includes on-demand cross-system device status checks and GitHub username synchronization for identity correlation.

Business Problem: Asset inventory is foundational for vulnerability management, offboarding, and compliance — but manually aggregating it from multiple systems is a weekly burden. This suite keeps the ITAM database current without manual effort and allows on-demand lookups across all asset data sources in a single query.

Category: Other

Subcategories: Endpoint hygiene & MDM ops, SaaS / IT administration

Integrations: CrowdStrike, JAMF, Jira (via AWS Secrets Manager), Snowflake, AWS S3, Slack, GitHub, Google Admin Console, Blink Tables

8. Endpoint & Device Management

Description: A suite of device wipe and lock playbooks spanning JAMF, JumpCloud, and Microsoft Intune — executable by serial number or user email. Includes post-action verification to confirm wipe commands completed successfully, with results logged to Google Sheets for audit trail.

Business Problem: Lost or offboarded employee devices require rapid remote wipe to prevent data exfiltration. This suite provides a consistent, cross-MDM interface to initiate and verify device wipes without requiring direct MDM console access.

Category: Other

Subcategories: Endpoint hygiene & MDM ops

Integrations: JAMF, JumpCloud, Microsoft Intune, Google Sheets, Blink Tables

9. Vulnerability Management

Description: On-demand vulnerability report generation using CrowdStrike's vuln dataset, with results delivered directly to stakeholders via email.

Business Problem: Vulnerability status reports requested by engineering teams or leadership typically require manual CrowdStrike console navigation and export. This playbook automates the retrieval and delivery in a single step.

Category: Vulnerability Mgmt

Subcategories: Vuln scanning ingest & report

Integrations: CrowdStrike, Blink email

10. Security Operations Support & Tooling

Description: Miscellaneous operational tooling supporting the security team — including on-call pay calculation from FireHydrant schedule data, a self-service Okta group provisioning web form, and a GitHub username testing workflow.

Category: Other

Subcategories: IT helpdesk & ticket routing, Financial & fraud operations

Integrations: FireHydrant, Okta, Slack, Google Sheets, Blink Web Forms

11. Vendor Risk & Security Review Automation

Description: Captures new procurement requests from Tropic (spend/vendor management platform) via webhook and drives them through a security review process — assigning Jira tasks to the security team and tracking review status to completion.

Business Problem: Every new vendor or procurement request requires a security review before purchase, but manually triaging each incoming request creates delays and inconsistent documentation. This automation intakes every request from Tropic and orchestrates the review through Jira, giving the security team a consistent, auditable process.

Category: GRC

Subcategories: Vendor risk & TPRM

Integrations: Tropic, Jira, Blink Tables, Google Drive

12. Threat Intelligence Digest Distribution

Description: Webhook-triggered pipeline that receives curated security/RSS content and posts it as a threaded digest message in Slack, keeping the security team informed of external threat intelligence and industry news without manual curation.

Business Problem: Staying current on emerging threats and industry security news requires manually checking multiple external feeds. This automation delivers a consolidated digest directly into the team's existing Slack workspace, removing the need for analysts to monitor sources individually.

Category: SOC

Subcategories: Threat intel ingest & curation

Integrations: Slack

Strengths

Mature end-to-end Agentic SOC. The Process Alert → Enrich → Respond pipeline is fully operational with 310 alerts processed, 381 enrichment routes fired, and 320 Expel closures synced — this is a production-grade, lights-out SOC workflow running at scale.

AI investigation agent is fully instrumented and running at scale. The Agentic SOC AI Investigation subflow completed 129 end-to-end investigations, backed by supporting agent abilities — 249 investigation guideline lookups, 193 VIP user checks, 149 org asset lookups, and 130 case-observable enrichment lookups — showing the AI agent is actively reasoning over case context during real investigations, not just running a fixed script.

Comprehensive enrichment coverage. 29 dedicated enrichment playbooks span 8+ threat intel and identity sources (VirusTotal, AbuseIPDB, URLScan, CrowdStrike, Okta, Google Workspace, Microsoft Entra ID, GitHub, Slack). The architecture correctly separates observable enrichment from case response routing, making the library reusable across alert types.

Robust data lake pipeline. Four security tooling sources (Terraform, FireHydrant, GitGuardian, Blink) feed daily into AWS S3 with consistent archiving patterns — 160 ingestion runs in 12 months. This indicates a mature log management strategy beyond just SIEM forwarding.

Strong ITAM foundation. The Build ITAM Database + CrowdStrike tag sync combination runs weekly and daily respectively, producing a continuously refreshed device inventory that underpins both the insider threat monitoring and the on-demand cscheck workflow.

Insider threat monitoring pipeline is active. Okta-based watchlist refreshes running 40 times in 12 months demonstrate a proactive approach to insider risk, not just reactive alerting.

Compromised user containment is architecture-complete. The full multi-tool containment suite (Okta, Google Workspace, Slack, Salesforce, JAMF) with Slack-based human approval is built and ready — a significant security capability that few organizations automate end-to-end.

Vendor risk intake is now automated end-to-end. The Tropic-triggered security review pipeline has processed 261 procurement requests and driven 51 review workflows to completion via Jira in its first period live — extending Blink's footprint from pure SOC/IAM into GRC vendor risk management.

Gaps & Opportunities

Enrichment subflows show 0 executions despite the enrichment router running 381 times. The individual enrichment playbooks (Enrich - IP - VT, Enrich - Hash - VT, etc.) all report 0 executions — worth validating that observable types are correctly mapped in the enrichment router and that playbook-level execution tracking is working as expected. If enrichments are running but not registering, this represents a reporting gap.

EDR containment is built but unused. CrowdStrike isolation and RTR playbooks have 0 executions. Given the active SOC pipeline, this likely means actual containment-triggering incidents haven't fired, or analysts are executing containment outside of Blink. Connecting these playbooks to the Response Subflow - Malware handler would close the loop.

Phishing response subflow has 0 executions. Despite the phishing response handler existing (including KnowBe4 campaign detection logic), it has never run. If phishing alerts are flowing through Panther, it's worth verifying the alert template mapping routes them correctly to this subflow.

Compromised user containment hasn't been exercised. The full containment suite (across two workspace variants) shows 0 executions. This is likely by design — these are break-glass workflows — but confirming the Slack approval flow works end-to-end via a tabletop exercise would de-risk the capability.

Vulnerability management coverage is minimal. With CrowdStrike vuln data available and a Snowflake connection in place, there's a clear opportunity to expand into automated vuln prioritization, Jira ticket creation, and SLA tracking — none of which exist today.

Multiple workspace variants for key workflows. Compromised User Containment, JAMF lock, and session revocation playbooks exist in 2-3 workspace copies each (workspaces 48453b3b, afa8215c, 178fdce3). Consolidating to a single production workspace would reduce maintenance overhead and ambiguity about which version is authoritative.

Integration Ecosystem