soteria — Customer Success Report

1. SOC Automation Platform

Description: A full-stack SOAR platform built on Blink's native case management — ingesting alerts, extracting observables, deduplicating into cases, routing automated response playbooks, and handling recovery for unprocessed events.

Business problem: Manual alert triage forces analysts to context-switch across tools for every incoming event. This platform automates the full alert-to-case lifecycle, including error recovery and stale case closure, so analysts work cases rather than chase raw alerts.

Integrations: Blink Case Management, Microsoft Outlook, CrowdStrike, KnowBe4

2. Multi-Source Observable Enrichment

Description: A modular enrichment pipeline that automatically enriches IOCs (IPs, URLs, hashes, domains, usernames, email addresses) across 10+ security and identity tools, updating observable records in case management with verdicts and metadata.

Business problem: Analysts spend significant time manually pivoting across tools to assess each IOC. This pipeline automates multi-source enrichment as part of the alert processing flow, delivering contextual verdicts before an analyst touches a case.

Integrations: CrowdStrike, VirusTotal, URLScan, AbuseIPDB, Okta, Google Workspace, Microsoft Entra ID, GitHub, Slack, Bash (Whois), Blink Case Management

3. On-Demand Threat Investigation

Description: A library of standalone enrichment and investigation utilities — reusable by analysts or callable from other workflows — covering user lookup, hash analysis, IP/domain reputation, DNS queries, URL scanning, and end-of-life data.

Business problem: Analysts need fast, repeatable enrichment primitives across a fragmented toolset. These on-demand workflows provide a consistent interface to query any tool without switching context.

Integrations: Google Workspace, GitHub, Microsoft Entra ID, VirusTotal, CrowdStrike, Okta, Slack, Bash (dig, whois), URLScan, Shodan, LimaCharlie

4. Security Alert Notification & Routing

Description: Event-driven workflows that receive Panther SIEM webhooks and route security alerts to stakeholders via email — with one general-purpose alerting engine and specialized variants for specific alert types and client environments.

Business problem: SIEM alert volume overwhelms analysts when delivered raw. These workflows act as a filtering and formatting layer, routing only actionable alerts to the right recipients with context.

Integrations: Panther, Blink Email

5. EDR Containment & Response

Description: Automated endpoint containment and remote command execution across CrowdStrike Falcon and Microsoft Defender for Endpoints — enabling device isolation, lift-of-isolation, and RTR commands with Slack-based human approval gates.

Business problem: Containing a compromised endpoint during an active incident requires rapid, coordinated action across EDR consoles. Manual steps introduce delay and inconsistency at the most time-critical moment.

Integrations: CrowdStrike, Microsoft Defender for Endpoints, SentinelOne, Slack

6. Identity Threat Response

Description: Analyst-driven identity remediation workflows with Slack approval loops — covering MFA enforcement checks, full user remediation (password reset, session revocation), and SharePoint file removal for Microsoft Entra ID and Okta environments.

Business problem: Responding to a compromised or risky user account requires coordinated, auditable actions across IAM platforms. Without automation, these responses are manual, slow, and inconsistently applied.

Integrations: Microsoft Entra ID, Okta, SentinelOne, Slack, SharePoint

7. Employee Lifecycle Automation

Description: End-to-end employee provisioning and deprovisioning — a web form-driven onboarding workflow that creates accounts, assigns equipment, and configures access across 10+ systems, and a corresponding offboarding workflow that revokes access, transfers data, and rotates credentials.

Business problem: Manual onboarding and offboarding across a complex SaaS stack is slow, error-prone, and creates security gaps — particularly around credential revocation and data transfer during offboarding.

Integrations: Google Workspace, Microsoft Entra ID, Asana, 1Password, Box, Slack, Atlassian, Harvest, Snipe-IT, Blink Web Forms, PowerShell

8. MDR Operations & Client Reporting

Description: Automated service delivery infrastructure for Soteria's MDR practice — generating monthly client touchpoint presentations from Google Drive templates, verifying database backup success across three environments, delivering daily LimaCharlie sensor health reports, and maintaining escalation and org-list data.

Business problem: MDR service teams need to deliver consistent, data-driven client touchpoints and operational monitoring at scale without manual effort per client or per environment.

Integrations: Google Drive, Google Slides, GCP BigQuery, LimaCharlie, Slack, Blink Email, GitHub, Blink Tables

9. Client AWS Provisioning (Panther MDR)

Description: Web form-driven workflow that creates and configures new AWS accounts for Panther SIEM clients — handling account creation, OU placement, IAM Identity Center group assignment, and task tracking in Asana.

Business problem: Onboarding a new client to the Panther MDR platform requires orchestrating multiple AWS Organizations and IAM operations that are error-prone when performed manually across accounts.

Integrations: AWS Organizations, AWS IAM Identity Center, Asana

10. Platform Operations & DevOps

Description: Infrastructure automation for the Blink platform itself — daily workflow definition backups to GitHub, and a scheduled digest that monitors and delivers Microsoft product change updates.

Business problem: Workflow configurations need to be version-controlled for audit and recovery. Microsoft platform changes need to reach relevant teams proactively rather than being discovered reactively.

Integrations: GitHub, Blink API, HTTP (Microsoft)

11. IT Helpdesk Ticket Automation

Description: A Slack slash-command-triggered workflow that creates a tracked task in Asana and confirms back to the requester in Slack.

Business problem: Ad-hoc requests submitted through chat are easy to lose track of. This workflow turns a Slack command into a tracked Asana ticket without the requester leaving Slack.

Integrations: Slack, Asana

Strengths

Full-stack SOAR platform built in-house. Soteria has assembled a production-grade case management and SOAR pipeline covering alert ingestion, observable extraction, multi-source enrichment, case deduplication, response routing, and recovery mechanisms. The modular subflow architecture — with separate enrichment, response, and error-handling layers — reflects mature automation design thinking.

MDR service delivery automated at scale. The MDR reporting suite is Soteria's most active area of execution. Monthly touchpoint presentations, daily sensor health reports, and three parallel backup verification automations run without manual intervention — a direct operational cost saving in service delivery. This reflects a compelling "Blink running a security operations business" story.

Breadth of enrichment coverage. The observable enrichment engine spans 10+ integrations across endpoint (CrowdStrike), threat intel (VirusTotal, AbuseIPDB, URLScan), identity (Okta, Entra ID, Google Workspace, GitHub), and network (Whois, Dig). This gives analysts multi-dimensional IOC context with a single automated trigger.

Alert notification at volume. The Panther-triggered alerting pipelines processed 5,170 notifications in 12 months, demonstrating that at least a portion of the automation stack is running in production at meaningful scale.

Richest employee onboarding in the stack. The User Onboarding Web Form orchestrates 10+ systems — Google Workspace, Entra ID, Asana, Box, 1Password, Slack, Atlassian, Harvest, Snipe-IT — in a single end-to-end workflow. This is operationally high-value and hard to replicate manually.

Agentic SOC capability deployed. The presence of "Activate Blackbeard" — a webhook-triggered workflow that invokes a Blink AI agent — signals that Soteria is actively piloting next-generation autonomous SOC capabilities.

Gaps & Opportunities

Core SOAR platform dormant. The primary alert processing pipeline — Process Alert, all 14 Enrich-* workflows, and the Response Router subflow — has zero executions despite being fully built. This is the largest investment in the platform and is likely in a pre-production, showcase, or staging state. Activating this pipeline would be the highest-leverage action in the account.

EDR response capacity unused. Six CrowdStrike, MDE, and SentinelOne containment workflows exist with 0 executions. As Soteria's MDR clients face active endpoint threats, response automation remains manual. Connecting these to the SOAR pipeline (via the Response Subflow - Malware) would close the loop from detection to containment.

Offboarding gap is a security risk. User onboarding has 5 executions; offboarding has 0. The offboarding workflow handles credential rotation, OneDrive transfer, and access revocation across Entra ID and Google Workspace — all high-risk steps if missed. This gap warrants immediate attention.

No vulnerability management workflows. There are no vuln scanning, CVE lookup, or patch prioritization workflows in the environment. For an MDR provider, this is a notable absence.

Phishing response pipeline built but untested. The Response Subflow - Phishing integrates Microsoft Outlook and detects KnowBe4 simulation headers, but has 0 executions. If Soteria handles phishing cases for clients, this represents untapped automation capacity.

Multi-workspace sprawl (10 workspaces). Soteria operates across 10 distinct Blink workspaces — likely representing different teams, clients, or product lines. While organizationally sensible, this creates governance and visibility challenges. Standardizing shared enrichment and response subflows across workspaces would reduce duplication.

Integration Ecosystem

Soteria's automation stack spans 20+ integrations across five domains: