Coterie — Customer Success Report

Metric Table

Use Case 1 — Agentic SOC: Sentinel Incident Investigation

Category: SOC

Subcategories: Agentic SOC · Alert enrichment / IOC lookup · Case mgmt & SOAR

Description: An AI-powered SOC analyst ("Cody") responds in real time to every Microsoft Sentinel alert via webhook. The agent autonomously gathers evidence from Log Analytics, enriches entity context using ProofPoint, Orca, Okta, VirusTotal, Purview, and Microsoft Graph, then writes findings directly back to the Sentinel incident. The 17 active agent tools in this use case were collectively invoked thousands of times in the past year, representing the deepest automation investment in the tenant.

Business problem solved: Eliminates analyst toil on Level 1 triage and enrichment for every Sentinel alert. Each incident arrives pre-investigated, allowing analysts to review conclusions rather than conduct evidence gathering from scratch.

Integrations: Microsoft Sentinel · Azure Log Analytics · Microsoft Graph / Entra ID · ProofPoint ITM · ProofPoint TAP · Orca Security · Okta Workforce · VirusTotal · MXToolBox · Microsoft Purview · Microsoft XDR Defender · NIST NVD · Traceable · PagerDuty

Use Case 2 — CVE Lifecycle Management & Reporting

Category: Vulnerability Mgmt

Subcategories: CVE lookup & remediation · Vuln scanning ingest & report · Vuln lifecycle prioritize & ticket

Description: Scheduled automations query Orca Security daily and weekly to identify cloud CVEs that are within SLA, approaching SLA, or overdue. Version 1.0 automatically creates Jira tickets for each affected team; version 2.0 converts findings to HTML and delivers email reports. A trending CVE workflow tracks longitudinal CVE posture by comparing weekly snapshots stored in Blink Tables.

Business problem solved: Eliminates manual CVE export-and-distribute workflows. Every cloud engineering team receives structured, SLA-bucketed CVE assignments without analyst intervention.

Integrations: Orca Security · Jira · Blink Tables · Blink Email · NIST NVD

Use Case 3 — Identity Incident Response Runbook Library

Category: SOC

Subcategories: Identity threat response · EDR containment & response

Description: A library of 12 on-demand IR playbooks covering the full spectrum of containment actions: Entra ID account disablement, Okta session revocation and suspension, MFA factor resets, password resets, Windows machine isolation, AV scan initiation, file hash blocking in Defender, IP blocklisting via Named Locations, URL/domain blocking via ZScaler, and email recipient lookups. All playbooks are designed to be triggered by the Cody AI agent or manually by analysts.

Business problem solved: Provides pre-built, pre-approved IR actions that can be executed in seconds rather than requiring manual portal access — reducing mean time to contain (MTTC) and enabling consistent, auditable response procedures.

Integrations: Microsoft Entra ID (Active Directory) · Microsoft Graph · Okta Workforce · Microsoft Defender for Endpoints · ZScaler ZIA · Azure Log Analytics

Use Case 4 — Agentic Employee Offboarding Investigation

Category: IAM

Subcategories: Employee offboarding · Identity lifecycle automation

Description: A comprehensive agentic offboarding workflow that gathers pre-termination activity across 8 data sources — sign-in logs, Azure Activity, Okta V2, audit logs, email events, Office Activity, ProofPoint CASB, ProofPoint device and email events, and GitHub — stores findings in structured Blink Tables, and feeds all evidence to a "Cody Offboarding Agent" that produces an AI-generated risk narrative. Results are written back to the Jira incident as a completed offboarding form. Each offboarding analysis involves a dedicated set of modular read playbooks called by the AI agent.

Business problem solved: Transforms offboarding security investigations from multi-day manual data-pulls across a dozen systems into a single automated workflow that delivers a complete AI-authored risk summary to the HR/security team, typically within minutes.

Integrations: Okta Workforce · Microsoft Entra ID · Azure Log Analytics · ProofPoint ITM · GitHub · Jira · Microsoft Graph · Blink Tables

Use Case 5 — Cloud Security Posture & Azure Policy Compliance

Category: Cloud Security

Subcategories: CSPM ingest & triage · Config audit & remediation

Description: Two cloud security posture workflows. The Azure Policy Remediation automation runs weekly across all Azure subscriptions, enumerating non-compliant policy assignments and submitting remediation tasks automatically. The Orca CSPM Alert Review feeds Orca cloud security alerts into a specialist "Cody Orca Agent" for AI-driven triage and prioritization.

Business problem solved: Eliminates the manual work of periodically checking and remediating Azure Policy non-compliance across multi-subscription environments, and speeds CSPM alert review by routing alerts directly to an AI security engineer.

Integrations: Azure (HTTP/REST — Azure Management API) · Orca Security

Use Case 6 — Okta CIAM Operations & Identity Monitoring

Category: IAM

Subcategories: Identity sync & directory mgmt · Identity lifecycle automation

Description: Automations managing the customer-facing Okta CIAM platform. The Agent Activation Query runs daily to check for new agent onboarding events and processes group membership changes. The CIAM Metrics workflow is event-driven, ingesting webhook data on authentication patterns (email auth, strong auth, SSO, partner integrations) and persisting them to Blink Tables for trending. The ZeroFox User Check correlates external brand-threat intelligence against CIAM user accounts to detect account takeover risk.

Business problem solved: Provides continuous monitoring and automated data collection for a production customer-identity platform, surfacing both operational anomalies and fraud signals without requiring manual CIAM log review.

Integrations: Okta CIAM (Production) · ZeroFox · Microsoft Sentinel · Blink Tables

Use Case 7 — Access Reviews & Privileged Access Governance

Category: GRC

Subcategories: RBAC review & access mgmt · Access review & group mgmt

Description: A structured program of access reviews covering both broad organizational entitlements (semi-annual review across 20+ apps, Azure role assignments, SQL database permissions, PIM group memberships, GitHub secrets) and targeted application-level reviews (WordPress, Bill.com, DropBox Sign, Grafana, SendGrid, Slack, Jira, BlinkOps, PagerDuty). An inactive user assessment identifies stale Entra ID accounts through sign-in telemetry and Graph API queries. A dedicated Azure PIM/Entra role eligibility review normalizes PIM group, Entra role, and nested group membership data (including a call to a standalone Azure SQL access review sub-automation) into a consolidated governance report, alongside standalone directory-administrator and subscription-level RBAC reviews. A newly expanded set of application- and platform-specific reviews adds Optro (AuditBoard) TPRM user access, GitHub organization membership, Stripe, Azure AD Enterprise Applications/Service Principals, Okta CIAM and Okta Workforce admin role assignments, and Intune RBAC role assignments to the governance program.

Business problem solved: Automates the evidence-gathering and report-generation phases of periodic access certifications, reducing review cycle time from days to minutes and ensuring consistent coverage across all in-scope systems.

Integrations: Okta Workforce · Okta CIAM · Microsoft Graph · Azure (REST) · Azure Log Analytics · PagerDuty · Blink (internal) · GitHub · Bill.com (HTTP) · WordPress (HTTP) · DropBox Sign (HTTP) · Grafana (HTTP) · SendGrid (HTTP) · Slack · Jira · Blink Email · AuditBoard (Optro) · Stripe (HTTP) · Microsoft Intune (via Graph)

Use Case 8 — Application Provisioning & Directory Sync

Category: IAM

Subcategories: Identity sync & directory mgmt · Identity lifecycle automation

Description: Provisioning automations for SaaS applications and directory synchronization tasks. The SCIM Provisioning 2.0 workflow processes Okta webhook events to manage the full create/update/deactivate lifecycle. Application-specific provisioners handle Bill.com, ProofPoint, WordPress, SendGrid, and BlinkOps accounts. The Catalog Refresh populates Microsoft Teams, Channels, and SharePoint site catalogs. A utility workflow syncs Okta group memberships to Azure/Entra.

Business problem solved: Standardizes application joiner/mover/leaver processes across SaaS tools, ensuring consistent provisioning logic, validation, and error handling without per-tool manual work.

Integrations: Okta Workforce · Microsoft Graph · Bill.com (HTTP) · ProofPoint ITM · WordPress (HTTP) · SendGrid (HTTP) · Blink

Use Case 9 — Endpoint & Conditional Access Configuration Review

Category: Cloud Security

Subcategories: Config audit & remediation · Cloud access & SaaS policy mgmt · Endpoint hygiene & MDM ops

Description: Two distinct review programs. The Endpoint Configuration Review (1.0, 1.1, 1.2) gathers Defender for Endpoint recommendations, Intune managed devices, device configurations, compliance policies, settings catalog, group policies, device intents, and Device Configuration Policy templates, then feeds all data to a "Cody MDE Agent" for an AI-authored security assessment. The Conditional Access Policy Review suite (1.0 through 1.16, plus the agent version) performs a comprehensive set of Log Analytics and Graph queries covering CA policy inventory, named locations, MFA bypass analysis, legacy authentication, non-compliant device sign-ins, service principals without CA applied, report-only CA blocks, blocked sign-ins by policy, risky-but-unblocked sign-ins, non-interactive sign-ins, users with no CA policy applied, and policy hit counts. Modules 1.3 through 1.16 each executed once in the most recent 12-month window, marking the pipeline's first full end-to-end pass.

Business problem solved: Replaces manual endpoint and identity posture reviews — tasks that typically require a qualified engineer spending multiple hours in portals — with automated data collection pipelines that deliver ready-to-review assessment packages.

Integrations: Microsoft Defender for Endpoints · Microsoft Graph · Azure Log Analytics · Microsoft Intune (via Graph)

Use Case 10 — Microsoft Sentinel SIEM Assessment Suite

Category: SOC

Subcategories: SIEM & log pipeline monitoring · Threat intel ingest & curation

Description: A 16-module Sentinel assessment framework that systematically evaluates every layer of the Sentinel deployment — analytics rules health, watchlist governance, content hub packages, data connector health, DCR configuration, workbook usage, Azure ML notebook inventory, automation/Logic App health, threat intelligence hygiene, hunting query promotion, UEBA/Fusion ML coverage, SOC Optimization recommendations, RBAC and PIM governance, and data retention/cost governance. The "Cody Sentinel Assessment Agent" orchestrates findings from all sub-modules into a consolidated assessment report.

Business problem solved: Enables rigorous periodic health checks of the Sentinel environment without requiring consultant-grade manual review. Each module produces structured data feeds that the AI agent synthesizes into actionable security engineering recommendations.

Integrations: Microsoft Sentinel (Azure Management REST API) · Azure Log Analytics · Microsoft Graph · Azure Monitor DCR API

Use Case 11 — Security Reporting & Email Security Monitoring

Category: GRC

Subcategories: Security metrics & reporting

Description: Scheduled reporting workflows that surface security and compliance telemetry on a recurring basis. The SendGrid Bounce List query runs daily, detecting unauthorized or anomalous outbound email relay activity. The ZScaler Usage Comparison runs weekly to identify users present in Okta but absent from ZScaler — a coverage gap indicator. The Documentation Gathering Agent automates evidence collection for compliance and audit documentation.

Business problem solved: Delivers repeatable security reporting with zero analyst scheduling overhead, ensuring that email relay hygiene and network security coverage gaps are surfaced on a fixed cadence.

Integrations: SendGrid (HTTP) · ZScaler ZIA · Azure Log Analytics · Okta CIAM

Use Case 12 — Third-Party Risk Management (TPRM)

Category: GRC

Subcategories: Vendor risk & TPRM

Description: An event-driven vendor risk workflow triggered via a custom webhook. On each trigger, the automation retrieves the current vendor list from the Optro (AuditBoard) TPRM platform and posts related risk data onward via HTTP, keeping downstream vendor risk records synchronized in near real time.

Business problem solved: Eliminates manual export/import cycles between the TPRM system of record and downstream consumers, ensuring vendor risk data stays current without analyst intervention. With 128 executions in the last 12 months, this is the customer's highest-volume GRC automation outside of core security metrics reporting.

Integrations: AuditBoard (Optro) · HTTP (custom)

Strengths

Production-grade agentic SOC. The Cody Sentinel analyst (Use Case 1) is the most active and mature automation in the tenant, having enriched 303 incidents and autonomously executed over 4,000 individual investigation steps across VirusTotal, ProofPoint, Okta, Azure Log Analytics, Orca, Purview, and Microsoft Graph. The breadth of agent tool coverage — 19 dedicated investigation abilities — is among the deepest agentic SOC deployments in the Blink customer base.

Multi-source offboarding intelligence. The offboarding investigation (Use Case 4) cross-references 8 distinct data sources and uses an AI agent to synthesize findings. This is a high-value, difficult-to-replicate workflow that would typically require a full-day manual investigation per departing employee.

CVE SLA discipline. Running two complementary CVE workflows daily (one for Jira ticket creation, one for email reporting) demonstrates a mature vulnerability management program with clear SLA accountability across development teams.

Extensive IR runbook coverage. The 12 IR playbooks (Use Case 3) span identity containment (Okta + Entra), endpoint response (Defender + ZScaler), and network blocking — a complete first-responder toolkit that is ready to integrate with the Cody agent for fully automated containment.

Sentinel assessment depth. The 16-module Sentinel assessment suite (Use Case 10) is highly sophisticated, covering areas most organizations never systematically review: UEBA baseline age, Fusion ML TP/FP rates, DCR standardization, notebook infrastructure, Logic App execution health, and retention/cost governance.

High-volume vendor risk automation. The newly instrumented TPRM - Optro workflow (Use Case 12) has already executed 128 times in the trailing 12 months, indicating an actively used, webhook-driven integration between the Optro/AuditBoard TPRM platform and downstream systems — the highest-volume GRC automation in the tenant outside of Sentinel incident enrichment.

Gaps & Opportunities

IR runbook activation. All 12 IR runbooks have zero executions. The Cody SOC agent is actively investigating incidents but is not yet invoking automated containment actions. Wiring the agent to the IR library would complete the automated SOC loop — moving from "investigate and recommend" to "investigate and contain."

Sentinel Assessment suite not yet active. The 16-module Sentinel assessment suite remains at zero executions. The Conditional Access Policy Review pipeline has now completed its first full pass (modules 1.3–1.16, one execution each), but the Endpoint Configuration Review programs remain unactivated. Scheduling the top-level orchestrators would fully unlock this build investment.

Access review program. The semi-annual access review (Use Case 7) and nearly all application access reviews have zero executions — now spanning 26 playbooks (SendGrid, Slack, Jira, BlinkOps, PagerDuty, Azure PIM/Entra role eligibility, Azure SQL, directory administrators, subscription RBAC, Optro/AuditBoard, GitHub, Stripe, Azure AD Enterprise Apps, Okta CIAM admin, Okta Workforce admin, and Intune, in addition to the original set), with only the Azure PIM, Azure SQL, and Okta CIAM Admin Access Review playbooks showing early adoption (1–2 executions each). Activating these with a recurring schedule would directly support compliance evidence collection for SOC 2 / ISO 27001 audit cycles.

Provisioning automation not activated. Six provisioning playbooks (Use Case 8) have zero executions. These cover several high-value SaaS tools (ProofPoint, Bill.com, WordPress) and represent an opportunity to eliminate manual JML request fulfilment.

Integration Ecosystem

The tenant integrates 20+ distinct security and business systems through Blink:

Metric Table

Use Case 1 — Agentic SOC: Sentinel Incident Investigation

Category: SOC

Subcategories: Agentic SOC · Alert enrichment / IOC lookup · Case mgmt & SOAR

Description: An AI-powered SOC analyst ("Cody") responds in real time to every Microsoft Sentinel alert via webhook. The agent autonomously gathers evidence from Log Analytics, enriches entity context using ProofPoint, Orca, Okta, VirusTotal, Purview, and Microsoft Graph, then writes findings directly back to the Sentinel incident. The 17 active agent tools in this use case were collectively invoked thousands of times in the past year, representing the deepest automation investment in the tenant.

Business problem solved: Eliminates analyst toil on Level 1 triage and enrichment for every Sentinel alert. Each incident arrives pre-investigated, allowing analysts to review conclusions rather than conduct evidence gathering from scratch.

Integrations: Microsoft Sentinel · Azure Log Analytics · Microsoft Graph / Entra ID · ProofPoint ITM · ProofPoint TAP · Orca Security · Okta Workforce · VirusTotal · MXToolBox · Microsoft Purview · Microsoft XDR Defender · NIST NVD · Traceable · PagerDuty

Use Case 2 — CVE Lifecycle Management & Reporting

Category: Vulnerability Mgmt

Subcategories: CVE lookup & remediation · Vuln scanning ingest & report · Vuln lifecycle prioritize & ticket

Description: Scheduled automations query Orca Security daily and weekly to identify cloud CVEs that are within SLA, approaching SLA, or overdue. Version 1.0 automatically creates Jira tickets for each affected team; version 2.0 converts findings to HTML and delivers email reports. A trending CVE workflow tracks longitudinal CVE posture by comparing weekly snapshots stored in Blink Tables.

Business problem solved: Eliminates manual CVE export-and-distribute workflows. Every cloud engineering team receives structured, SLA-bucketed CVE assignments without analyst intervention.

Integrations: Orca Security · Jira · Blink Tables · Blink Email · NIST NVD

Use Case 3 — Identity Incident Response Runbook Library

Category: SOC

Subcategories: Identity threat response · EDR containment & response

Description: A library of 12 on-demand IR playbooks covering the full spectrum of containment actions: Entra ID account disablement, Okta session revocation and suspension, MFA factor resets, password resets, Windows machine isolation, AV scan initiation, file hash blocking in Defender, IP blocklisting via Named Locations, URL/domain blocking via ZScaler, and email recipient lookups. All playbooks are designed to be triggered by the Cody AI agent or manually by analysts.

Business problem solved: Provides pre-built, pre-approved IR actions that can be executed in seconds rather than requiring manual portal access — reducing mean time to contain (MTTC) and enabling consistent, auditable response procedures.

Integrations: Microsoft Entra ID (Active Directory) · Microsoft Graph · Okta Workforce · Microsoft Defender for Endpoints · ZScaler ZIA · Azure Log Analytics

Use Case 4 — Agentic Employee Offboarding Investigation

Category: IAM

Subcategories: Employee offboarding · Identity lifecycle automation

Description: A comprehensive agentic offboarding workflow that gathers pre-termination activity across 8 data sources — sign-in logs, Azure Activity, Okta V2, audit logs, email events, Office Activity, ProofPoint CASB, ProofPoint device and email events, and GitHub — stores findings in structured Blink Tables, and feeds all evidence to a "Cody Offboarding Agent" that produces an AI-generated risk narrative. Results are written back to the Jira incident as a completed offboarding form. Each offboarding analysis involves a dedicated set of modular read playbooks called by the AI agent.

Business problem solved: Transforms offboarding security investigations from multi-day manual data-pulls across a dozen systems into a single automated workflow that delivers a complete AI-authored risk summary to the HR/security team, typically within minutes.

Integrations: Okta Workforce · Microsoft Entra ID · Azure Log Analytics · ProofPoint ITM · GitHub · Jira · Microsoft Graph · Blink Tables

Use Case 5 — Cloud Security Posture & Azure Policy Compliance

Category: Cloud Security

Subcategories: CSPM ingest & triage · Config audit & remediation

Description: Two cloud security posture workflows. The Azure Policy Remediation automation runs weekly across all Azure subscriptions, enumerating non-compliant policy assignments and submitting remediation tasks automatically. The Orca CSPM Alert Review feeds Orca cloud security alerts into a specialist "Cody Orca Agent" for AI-driven triage and prioritization.

Business problem solved: Eliminates the manual work of periodically checking and remediating Azure Policy non-compliance across multi-subscription environments, and speeds CSPM alert review by routing alerts directly to an AI security engineer.

Integrations: Azure (HTTP/REST — Azure Management API) · Orca Security

Use Case 6 — Okta CIAM Operations & Identity Monitoring

Category: IAM

Subcategories: Identity sync & directory mgmt · Identity lifecycle automation

Description: Automations managing the customer-facing Okta CIAM platform. The Agent Activation Query runs daily to check for new agent onboarding events and processes group membership changes. The CIAM Metrics workflow is event-driven, ingesting webhook data on authentication patterns (email auth, strong auth, SSO, partner integrations) and persisting them to Blink Tables for trending. The ZeroFox User Check correlates external brand-threat intelligence against CIAM user accounts to detect account takeover risk.

Business problem solved: Provides continuous monitoring and automated data collection for a production customer-identity platform, surfacing both operational anomalies and fraud signals without requiring manual CIAM log review.

Integrations: Okta CIAM (Production) · ZeroFox · Microsoft Sentinel · Blink Tables

Use Case 7 — Access Reviews & Privileged Access Governance

Category: GRC

Subcategories: RBAC review & access mgmt · Access review & group mgmt

Description: A structured program of access reviews covering both broad organizational entitlements (semi-annual review across 20+ apps, Azure role assignments, SQL database permissions, PIM group memberships, GitHub secrets) and targeted application-level reviews (WordPress, Bill.com, DropBox Sign, Grafana, SendGrid, Slack, Jira, BlinkOps, PagerDuty). An inactive user assessment identifies stale Entra ID accounts through sign-in telemetry and Graph API queries. A dedicated Azure PIM/Entra role eligibility review normalizes PIM group, Entra role, and nested group membership data (including a call to a standalone Azure SQL access review sub-automation) into a consolidated governance report, alongside standalone directory-administrator and subscription-level RBAC reviews. A newly expanded set of application- and platform-specific reviews adds Optro (AuditBoard) TPRM user access, GitHub organization membership, Stripe, Azure AD Enterprise Applications/Service Principals, Okta CIAM and Okta Workforce admin role assignments, and Intune RBAC role assignments to the governance program.

Business problem solved: Automates the evidence-gathering and report-generation phases of periodic access certifications, reducing review cycle time from days to minutes and ensuring consistent coverage across all in-scope systems.

Integrations: Okta Workforce · Okta CIAM · Microsoft Graph · Azure (REST) · Azure Log Analytics · PagerDuty · Blink (internal) · GitHub · Bill.com (HTTP) · WordPress (HTTP) · DropBox Sign (HTTP) · Grafana (HTTP) · SendGrid (HTTP) · Slack · Jira · Blink Email · AuditBoard (Optro) · Stripe (HTTP) · Microsoft Intune (via Graph)

Use Case 8 — Application Provisioning & Directory Sync

Category: IAM

Subcategories: Identity sync & directory mgmt · Identity lifecycle automation

Description: Provisioning automations for SaaS applications and directory synchronization tasks. The SCIM Provisioning 2.0 workflow processes Okta webhook events to manage the full create/update/deactivate lifecycle. Application-specific provisioners handle Bill.com, ProofPoint, WordPress, SendGrid, and BlinkOps accounts. The Catalog Refresh populates Microsoft Teams, Channels, and SharePoint site catalogs. A utility workflow syncs Okta group memberships to Azure/Entra.

Business problem solved: Standardizes application joiner/mover/leaver processes across SaaS tools, ensuring consistent provisioning logic, validation, and error handling without per-tool manual work.

Integrations: Okta Workforce · Microsoft Graph · Bill.com (HTTP) · ProofPoint ITM · WordPress (HTTP) · SendGrid (HTTP) · Blink

Use Case 9 — Endpoint & Conditional Access Configuration Review

Category: Cloud Security

Subcategories: Config audit & remediation · Cloud access & SaaS policy mgmt · Endpoint hygiene & MDM ops

Description: Two distinct review programs. The Endpoint Configuration Review (1.0, 1.1, 1.2) gathers Defender for Endpoint recommendations, Intune managed devices, device configurations, compliance policies, settings catalog, group policies, device intents, and Device Configuration Policy templates, then feeds all data to a "Cody MDE Agent" for an AI-authored security assessment. The Conditional Access Policy Review suite (1.0 through 1.16, plus the agent version) performs a comprehensive set of Log Analytics and Graph queries covering CA policy inventory, named locations, MFA bypass analysis, legacy authentication, non-compliant device sign-ins, service principals without CA applied, report-only CA blocks, blocked sign-ins by policy, risky-but-unblocked sign-ins, non-interactive sign-ins, users with no CA policy applied, and policy hit counts. Modules 1.3 through 1.16 each executed once in the most recent 12-month window, marking the pipeline's first full end-to-end pass.

Business problem solved: Replaces manual endpoint and identity posture reviews — tasks that typically require a qualified engineer spending multiple hours in portals — with automated data collection pipelines that deliver ready-to-review assessment packages.

Integrations: Microsoft Defender for Endpoints · Microsoft Graph · Azure Log Analytics · Microsoft Intune (via Graph)

Use Case 10 — Microsoft Sentinel SIEM Assessment Suite

Category: SOC

Subcategories: SIEM & log pipeline monitoring · Threat intel ingest & curation

Description: A 16-module Sentinel assessment framework that systematically evaluates every layer of the Sentinel deployment — analytics rules health, watchlist governance, content hub packages, data connector health, DCR configuration, workbook usage, Azure ML notebook inventory, automation/Logic App health, threat intelligence hygiene, hunting query promotion, UEBA/Fusion ML coverage, SOC Optimization recommendations, RBAC and PIM governance, and data retention/cost governance. The "Cody Sentinel Assessment Agent" orchestrates findings from all sub-modules into a consolidated assessment report.

Business problem solved: Enables rigorous periodic health checks of the Sentinel environment without requiring consultant-grade manual review. Each module produces structured data feeds that the AI agent synthesizes into actionable security engineering recommendations.

Integrations: Microsoft Sentinel (Azure Management REST API) · Azure Log Analytics · Microsoft Graph · Azure Monitor DCR API

Use Case 11 — Security Reporting & Email Security Monitoring

Category: GRC

Subcategories: Security metrics & reporting

Description: Scheduled reporting workflows that surface security and compliance telemetry on a recurring basis. The SendGrid Bounce List query runs daily, detecting unauthorized or anomalous outbound email relay activity. The ZScaler Usage Comparison runs weekly to identify users present in Okta but absent from ZScaler — a coverage gap indicator. The Documentation Gathering Agent automates evidence collection for compliance and audit documentation.

Business problem solved: Delivers repeatable security reporting with zero analyst scheduling overhead, ensuring that email relay hygiene and network security coverage gaps are surfaced on a fixed cadence.

Integrations: SendGrid (HTTP) · ZScaler ZIA · Azure Log Analytics · Okta CIAM

Use Case 12 — Third-Party Risk Management (TPRM)

Category: GRC

Subcategories: Vendor risk & TPRM

Description: An event-driven vendor risk workflow triggered via a custom webhook. On each trigger, the automation retrieves the current vendor list from the Optro (AuditBoard) TPRM platform and posts related risk data onward via HTTP, keeping downstream vendor risk records synchronized in near real time.

Business problem solved: Eliminates manual export/import cycles between the TPRM system of record and downstream consumers, ensuring vendor risk data stays current without analyst intervention. With 128 executions in the last 12 months, this is the customer's highest-volume GRC automation outside of core security metrics reporting.

Integrations: AuditBoard (Optro) · HTTP (custom)

Strengths

Production-grade agentic SOC. The Cody Sentinel analyst (Use Case 1) is the most active and mature automation in the tenant, having enriched 303 incidents and autonomously executed over 4,000 individual investigation steps across VirusTotal, ProofPoint, Okta, Azure Log Analytics, Orca, Purview, and Microsoft Graph. The breadth of agent tool coverage — 19 dedicated investigation abilities — is among the deepest agentic SOC deployments in the Blink customer base.

Multi-source offboarding intelligence. The offboarding investigation (Use Case 4) cross-references 8 distinct data sources and uses an AI agent to synthesize findings. This is a high-value, difficult-to-replicate workflow that would typically require a full-day manual investigation per departing employee.

CVE SLA discipline. Running two complementary CVE workflows daily (one for Jira ticket creation, one for email reporting) demonstrates a mature vulnerability management program with clear SLA accountability across development teams.

Extensive IR runbook coverage. The 12 IR playbooks (Use Case 3) span identity containment (Okta + Entra), endpoint response (Defender + ZScaler), and network blocking — a complete first-responder toolkit that is ready to integrate with the Cody agent for fully automated containment.

Sentinel assessment depth. The 16-module Sentinel assessment suite (Use Case 10) is highly sophisticated, covering areas most organizations never systematically review: UEBA baseline age, Fusion ML TP/FP rates, DCR standardization, notebook infrastructure, Logic App execution health, and retention/cost governance.

High-volume vendor risk automation. The newly instrumented TPRM - Optro workflow (Use Case 12) has already executed 128 times in the trailing 12 months, indicating an actively used, webhook-driven integration between the Optro/AuditBoard TPRM platform and downstream systems — the highest-volume GRC automation in the tenant outside of Sentinel incident enrichment.

Gaps & Opportunities

IR runbook activation. All 12 IR runbooks have zero executions. The Cody SOC agent is actively investigating incidents but is not yet invoking automated containment actions. Wiring the agent to the IR library would complete the automated SOC loop — moving from "investigate and recommend" to "investigate and contain."

Sentinel Assessment suite not yet active. The 16-module Sentinel assessment suite remains at zero executions. The Conditional Access Policy Review pipeline has now completed its first full pass (modules 1.3–1.16, one execution each), but the Endpoint Configuration Review programs remain unactivated. Scheduling the top-level orchestrators would fully unlock this build investment.

Access review program. The semi-annual access review (Use Case 7) and nearly all application access reviews have zero executions — now spanning 26 playbooks (SendGrid, Slack, Jira, BlinkOps, PagerDuty, Azure PIM/Entra role eligibility, Azure SQL, directory administrators, subscription RBAC, Optro/AuditBoard, GitHub, Stripe, Azure AD Enterprise Apps, Okta CIAM admin, Okta Workforce admin, and Intune, in addition to the original set), with only the Azure PIM, Azure SQL, and Okta CIAM Admin Access Review playbooks showing early adoption (1–2 executions each). Activating these with a recurring schedule would directly support compliance evidence collection for SOC 2 / ISO 27001 audit cycles.

Provisioning automation not activated. Six provisioning playbooks (Use Case 8) have zero executions. These cover several high-value SaaS tools (ProofPoint, Bill.com, WordPress) and represent an opportunity to eliminate manual JML request fulfilment.

Integration Ecosystem

The tenant integrates 20+ distinct security and business systems through Blink: