sccic — Customer Success Report

Total playbooks: 84

1. Agentic SOC Platform

Category: SOC | Subcategories: Case mgmt & SOAR, Agentic SOC

Description: A fully automated SOC case management pipeline that ingests alerts from external tools (CrowdStrike, Proofpoint, Okta), deduplicates and enriches them, creates or appends to cases, triggers playbook-based response by alert type, and generates AI-assisted incident reports with full timelines. Includes recovery automation for unprocessed alerts and observable backfill.

Business problem solved: SOC analysts spend hours manually triaging, correlating, and documenting alerts. This platform automates alert-to-case lifecycle management end-to-end — from first ingest through enrichment, response routing, and post-incident reporting — compressing analyst time and accelerating mean time to respond.

Integrations: Blink Case Management, CrowdStrike, Microsoft Outlook, AI Agents (Truskey Jr | Build Reports and Timelines)

Playbooks:

2. Alert Enrichment & IOC Investigation

Category: SOC | Subcategories: Alert enrichment / IOC lookup

Description: A comprehensive, multi-source enrichment library that automatically investigates indicators of compromise — IPs, file hashes, URLs, domains, usernames, and email addresses — across nine integrated security platforms. The enrichment router dispatches each observable type to the appropriate tool and writes verdicts back into the case management system.

Business problem solved: Manual IOC lookups across multiple tools consume significant analyst time and introduce inconsistency. This library gives analysts instant, structured enrichment on every observable — automatically, at scale, during every alert triage cycle.

Integrations: CrowdStrike, VirusTotal, URLScan, AbuseIPDB, Okta, Google Workspace, Microsoft Entra ID, GitHub, Slack, Whois, IPInfo

Playbooks:

3. EDR Containment & Remote Response

Category: SOC | Subcategories: EDR containment & response

Description: Enables analysts to isolate compromised endpoints and execute remote commands via CrowdStrike's Real-Time Response (RTR) capability — both on individual hosts and in bulk across a fleet. Designed to be invoked as part of the malware response subflow or manually during active incident response.

Business problem solved: Containing a compromised host requires coordinating multiple manual steps across tools. These playbooks make containment a single-click operation from within the SOAR platform, reducing time-to-containment from minutes to seconds.

Integrations: CrowdStrike

Playbooks:

4. Phishing Detection & Response

Category: SOC | Subcategories: Phishing detection & response

Description: End-to-end phishing handling — from analyst-submitted email analysis through a web form, to message trace investigation for downstream recipient exposure, to formal phishing takedown submission. Includes an AI agent for parsing email content and extracting observables.

Business problem solved: Phishing incidents require analysts to manually parse emails, identify affected recipients, trace message delivery, and coordinate takedown requests. This use case automates each step — from first submission through stakeholder notification and site takedown — reducing analyst work and accelerating remediation.

Integrations: Microsoft Outlook, AI Agents (email agent), Blink Web Forms

Playbooks:

5. Ransomware Intelligence & Victim Alerting

Category: SOC | Subcategories: Threat intel ingest & curation

Description: Automated monitoring of public ransomware extortion leak sites (via ransomware.live) on a 4-hour cadence. An AI agent scans victim lists for South Carolina organizations and triggers automated email alerts to SCCIC stakeholders when SC victims are identified. Complements this with VPS threat actor infrastructure tracking.

Business problem solved: Manually monitoring ransomware extortion sites for relevant victims is time-consuming and unreliable. This use case ensures no SC victim posting goes undetected — 24/7, without analyst involvement — and delivers structured, actionable alerts automatically.

Integrations: ransomware.live API, AI Agents (South Carolina Finder), Blink Tables, Email

Playbooks:

6. Threat Intelligence & Attack Surface Monitoring

Category: SOC | Subcategories: Threat intel ingest & curation, Threat hunting & detection

Description: Proactive threat intelligence operations: keeping Recorded Future domain watchlists in sync with the live Cyber Liaison Officer (CLO) database, querying Shodan for IPs associated with known-bad hostnames, checking IP reputation via AbuseIPDB, pulling and validating Recorded Future's C2 server list to feed the EDL manager, and tracking parked domains for ongoing monitoring. Ensures threat intelligence tooling reflects the current SC government organizational footprint.

Business problem solved: Threat intelligence is only as useful as its coverage — if monitored domains fall out of sync with the actual organizational roster, alerts are missed. This use case automates the maintenance of watchlists and performs continuous external exposure scanning.

Integrations: Recorded Future, Shodan, AbuseIPDB, Blink Tables, HTTP/EDL Manager

Playbooks:

7. Assessment Services Coordination

Category: GRC | Subcategories: Compliance questionnaire, Security metrics & reporting

Description: Automates the intake, routing, and follow-up lifecycle for SCCIC's portfolio of cyber services offered to South Carolina government organizations — including M365 Assessments, Vulnerability Scanning, Active Directory Audits, Threat Intelligence services, and CyberDefenders training. Pulls service requests from SharePoint, identifies the relevant Cyber Liaison Officer (CLO) contacts, sends notifications, and updates records automatically. Maintains synchronized CLO and organization databases from SharePoint as the system of record.

Business problem solved: Managing dozens of service requests across multiple government agencies requires constant manual tracking, email coordination, and record-keeping. This use case automates the full request-to-notification workflow — ensuring no service requests fall through the cracks and CLO databases remain current without manual effort.

Integrations: SharePoint (SLED), Blink Tables, Email

Playbooks:

8. Security Assessment Report Generation

Category: GRC | Subcategories: Security metrics & reporting

Description: Automates the generation and delivery of structured security assessment reports in Plextrac — SCCIC's reporting platform. Given a client name, findings list, and report date, the automation locates the client in Plextrac, creates a new report, populates it with relevant writeups from the library, and emails the completed report to the recipient. Supports Active Directory assessments and general security assessments.

Business problem solved: Producing formatted assessment reports in a client-facing platform is time-intensive and error-prone when done manually. These playbooks allow SCCIC analysts to generate professional, consistent Plextrac reports with a single trigger — dramatically accelerating report delivery to SC government agencies.

Integrations: Plextrac, Email

Playbooks:

9. Credential Leak Intelligence

Category: GRC | Subcategories: DLP triage & exposure resp

Description: Parses and structures raw leaked credential data — including unstructured or semi-structured credential dumps — extracting, deduplicating, and sorting the credentials into a normalized format for analyst review and downstream response.

Business problem solved: Leaked credential dumps arrive in inconsistent, often raw formats that are difficult to act on without preprocessing. This playbook turns raw leak data into a structured, actionable list — accelerating the analyst's ability to identify affected accounts and initiate password resets or account lockdowns.

Integrations: Python processing

Playbooks:

Strengths

Deep SOAR investment with a purpose-built case management platform. SCCIC has built a fully custom, Blink-native case management system — complete with observable tracking, deduplication, enrichment routing, response subflows, and recovery automation. The platform architecture (22 interconnected playbooks) reflects a mature, production-grade SOAR deployment, not a collection of isolated scripts.

Multi-source enrichment depth. The enrichment library spans nine platforms — CrowdStrike, VirusTotal, URLScan, AbuseIPDB, Okta, Microsoft Entra ID, Google Workspace, GitHub, and Slack. This breadth means that virtually every observable type encountered in an alert can be automatically enriched without analyst intervention.

Agentic SOC capabilities. Two AI agents are deployed in production: one for phishing email analysis and one (Truskey Jr) for generating case reports and timelines. The Build Case Report and Timeline playbook — already used 8 times — represents a genuine shift toward AI-assisted incident documentation, a leading-edge capability in government SOC environments.

Ransomware monitoring with real operational impact. The ransomware extortion monitoring pipeline (217 scans, 15 victim alerts delivered) is a high-value, continuous operation that would be impractical to replicate manually. Running every 4 hours around the clock, it ensures no South Carolina victim goes unreported.

Structured services delivery at scale. The assessment services coordination use case (M365, Vulnerability Scanning, AD Audit, Threat Intelligence) runs on scheduled cadences tied directly to SharePoint as the system of record. The daily CLO and org list database synchronizations (36 + 7 runs) ensure the entire downstream automation ecosystem stays accurate without human upkeep.

Plextrac report generation at scale. 77 assessment reports generated automatically across Plextrac represents significant analyst time saved on a typically high-effort task. With 73 executions on a single playbook, report generation is clearly a high-frequency operation.

Gaps & Opportunities

SOAR pipeline not yet running in production. The core Process Alert event playbook shows 0 executions, meaning the full alert-to-case automation pipeline has been built and tested (via the simulator playbooks) but has not yet processed live production alerts. Once activated, this platform has the potential to automate hundreds of alert triage cycles per month.

Enrichment playbooks at zero executions. All 28 enrichment playbooks show 0 executions — consistent with the SOAR pipeline not yet processing live alerts. As the alert pipeline comes online, enrichment volume will increase proportionally. The library is ready; the trigger is the missing piece.

EDR containment capabilities built but dormant. CrowdStrike endpoint isolation and RTR capabilities are built and integrated but have not been invoked. These are high-value response actions that could significantly reduce mean time to contain once the SOAR pipeline is live.

Phishing email analysis web form at zero executions. The web-form-based phishing submission workflow (workspace 7c9e1f21) is configured and ready but has not received any submissions. Analyst awareness and adoption may be a driver to address.

Duplicate playbooks suggest iterative development. Several playbooks exist in duplicate across workspaces (two Message Trace Analysis playbooks, two AD Assessment Reports variants, one copy). Consolidating these would reduce maintenance surface and ensure consistent execution.

CyberDefenders and Bad VPS Templates at zero. These scheduled playbooks are configured but show no execution history — they may be paused, awaiting data sources, or in early development.

Integration Ecosystem