usana — Customer Success Report

1. Guard Detect Alert Management

Description: Converts raw Guard Detect webhook events into enriched, structured Jira tickets and handles post-creation sensitive data redaction. Ensures every detection surfaces as a trackable security case within seconds of the alert firing.

Business problem solved: Guard Detect generates high volumes of security alerts that previously required manual ticket creation and sensitive-data cleanup. This use case eliminates that manual bottleneck and ensures consistent, auditable case records.

Key integrations: Guard Detect (webhook), Jira, Microsoft Graph (GraphQL)

Taxonomy: SOC → Case mgmt & SOAR

2. O365 Suspicious Login Detection

Description: Runs daily at 8:05 AM MT to pull open Jira issues flagged as O365 successful logins from foreign countries, looks up the current SecOps on-call user via PagerDuty, and routes each alert through a per-issue investigation loop.

Business problem solved: Foreign login events in Office 365 require timely investigation but are easily missed in Jira queues. This use case ensures daily sweep coverage and automatic on-call routing without analyst calendar coordination.

Key integrations: Jira, PagerDuty, Microsoft 365

Taxonomy: SOC → Identity threat response, SIEM & log pipeline monitoring

3. Recorded Future Threat Intel Enrichment

Description: Fetches and structures Recorded Future API reference documentation, loops through observable items to gather triage context, and annotates Jira tickets with enriched threat intelligence in Atlassian Document Format.

Business problem solved: Analysts manually consulting Recorded Future for each observable is slow and inconsistent. This use case automates intel retrieval and formats it directly onto the Jira ticket, reducing mean time to context.

Key integrations: Recorded Future, Jira, HTTP

Taxonomy: SOC → Threat intel ingest & curation

4. AI-Driven Security Operations

Description: A suite of agentic workflows that use Blink AI agents to select and execute the right workflow based on a natural-language prompt, evaluate risk decisions through an AI Risk Management Framework agent, and trigger the full capability set from Jira automation rules.

Business problem solved: Complex multi-step investigations previously required an analyst to know which workflow to run and manually chain lookups. These workflows enable prompt-driven automation — an analyst or Jira rule can describe intent in plain language and Blink orchestrates the rest.

Key integrations: Blink AI agents, Jira, Blink API

Taxonomy: SOC → Agentic SOC

5. Avanan Email Security Investigation

Description: Authenticates to the Avanan API using a HMAC-SHA256 token generation process and retrieves event details tied to email addresses extracted from Jira issues, with AI-assisted analysis of the event data for security insights.

Business problem solved: Investigating Avanan email security events requires multi-step API authentication and manual correlation with Jira case data. This use case automates the full enrichment pipeline from ticket context to Avanan event retrieval.

Key integrations: Avanan (HTTP), Jira, Microsoft Entra ID, Blink AI agents

Taxonomy: SOC → Phishing detection & response

6. IOC Verification

Description: Accepts a CSV file of indicators, extracts the third column (IP addresses), and loops each through VirusTotal for scan results, storing findings in a table.

Business problem solved: Bulk IOC lookups against VirusTotal are tedious to run manually at scale. This use case automates batch IOC verification from structured input files.

Key integrations: VirusTotal (HTTP), Blink Tables

Taxonomy: SOC → Alert enrichment / IOC lookup

7. Azure AD Identity Enrichment

Description: Provides on-demand Azure AD / Entra ID lookups covering user profiles (with manager details), group memberships, email-to-name resolution, and Intune-managed device details by hostname. Used as a data enrichment layer across multiple SOC workflows.

Business problem solved: Analyst investigations regularly require user context (job title, manager, groups, enrolled devices) that spans multiple Microsoft Graph API calls. This use case consolidates those lookups into callable service functions, eliminating repetitive manual AD queries.

Key integrations: Microsoft Graph / Entra ID, Microsoft Intune

Taxonomy: IAM → Identity sync & directory mgmt

8. Vault & Credential Lifecycle Management

Description: Manages the full lifecycle of HashiCorp Vault credentials and 1Password secrets used by SecOps automation — from 32-day token creation through scheduled renewal, orphaned token recovery, and synchronized updates to Blink connections and 1Password vaults. A separate scheduled workflow handles Jira-ticketed transit key deletions.

Business problem solved: Vault tokens expire and if not renewed proactively, all downstream automation fails silently. This use case implements a fully autonomous credential renewal loop (every 8 hours) and provides Jira-driven transit key governance to eliminate operational gaps and audit trail deficiencies.

Key integrations: HashiCorp Vault, 1Password, Jira, Blink API

Taxonomy: IAM → Password & credential lifecycle

9. SentinelOne Endpoint Agent Management

Description: A comprehensive set of workflows covering the full SentinelOne agent lifecycle: enumerating agents by group and machine type, identifying outdated or inactive machines, retrieving the latest available version per OS, initiating bulk upgrades, and monitoring upgrade task status. Multiple workspace variants reflect iterative development across sandbox and production environments.

Business problem solved: Keeping hundreds of workstation SentinelOne agents on the latest version is operationally intensive — agents must be inventoried by group, compared against the latest release, and upgraded in batches while tracking success/failure per host. This use case automates the entire identify-compare-upgrade-verify cycle.

Key integrations: SentinelOne, Jira, Blink AI agents (version resolution), Blink API (subflow orchestration)

Taxonomy: Other → Endpoint hygiene & MDM ops

10. Rapid7 Vulnerability Intelligence

Description: Provides a complete CVE investigation toolkit: asset lookup by hostname or IP, CVE-to-affected-hosts mapping, vulnerability solution retrieval by CVE or vulnerability ID, and bulk asset deletion for decommissioned hosts. The CVE search workflow ties these together into a Jira-initiated investigation flow with AI-generated summaries.

Business problem solved: CVE investigations require correlating scanner data (which assets are affected) with remediation guidance (what to fix) and Jira ticket context — steps that span multiple Rapid7 API calls and manual lookups. This use case provides a single-entry-point investigation chain callable from Jira or on demand.

Key integrations: Rapid7 InsightVM / Nexpose, Jira, Blink AI agents

Taxonomy: Vulnerability Mgmt → CVE lookup & remediation, Vuln lifecycle prioritize & ticket

11. On-Call Management & Cross-Platform Notification

Description: Maintains real-time on-call identity across Microsoft Teams channels and Slack by polling PagerDuty for the current SecOps on-call user (including override schedules) and propagating name/email updates to five Teams channel topics and the Slack on-call group — hourly for the main sync and daily for the Teams-specific update.

Business problem solved: When on-call rotates, Teams channel topics and Slack groups become stale within minutes unless manually updated — a toil-heavy process that fails silently during incident response. This use case makes on-call identity always current across all collaboration surfaces without any manual action.

Key integrations: PagerDuty, Microsoft Teams (Graph API), Slack, Blink Templates

Taxonomy: Other → SaaS / IT administration

12. Jira Operations & Sprint Automation

Description: Provides Jira lifecycle utilities — searching issues by arbitrary JQL, reassigning tickets to on-call users by email, and fully automating bi-weekly sprint transitions (close old sprint, create new sprint, move open issues).

Business problem solved: Sprint management and ticket routing are recurring manual tasks that interrupt SecOps analysts. Auto-reassignment ensures tickets immediately reach the active on-call owner, while sprint transition eliminates a repetitive 7-step admin procedure.

Key integrations: Jira, Blink AI agents (sprint planning assistance)

Taxonomy: Other → IT helpdesk & ticket routing

13. Infrastructure Asset Inventory

Description: Cross-platform device and infrastructure lookup toolkit — retrieving VMware vSphere VM details by hostname, compiling a unified device profile from SentinelOne, Rapid7, Intune, JAMF, and vSphere in a single call, posting notification messages to Teams, and querying SharePoint for international traveler registrations.

Business problem solved: Device context during incidents requires querying 4–5 separate systems. The get_device_profile workflow aggregates SentinelOne agent details, Rapid7 asset data, Intune enrollment, JAMF records, and vSphere VM data into one structured output, cutting investigation time significantly.

Key integrations: VMware vSphere, SentinelOne, Rapid7, Microsoft Intune, JAMF, SharePoint, Microsoft Teams

Taxonomy: Other → IT/OT & network infra monitoring

15. AD Password Policy Compliance Evidence Collection

Description: Remotely connects to a target Windows host over WinRM and executes a PowerShell script to collect Active Directory password policy configuration as auditable evidence.

Business problem solved: Compliance audits require documented proof of AD password policy settings, which is normally gathered through manual remote sessions and screenshots. This use case automates remote evidence collection via WinRM, producing a repeatable, auditable capture of policy state.

Key integrations: Windows Remote Management (WinRM), PowerShell

Taxonomy: GRC → Security metrics & reporting

Strengths

Deep integration ecosystem. The automation library spans 14 integrated platforms: Jira, SentinelOne, Microsoft Graph/Entra ID, Rapid7 InsightVM, PagerDuty, HashiCorp Vault, 1Password, Microsoft Teams, Slack, Avanan, VMware vSphere, JAMF, Recorded Future, and SharePoint. This breadth places the environment among the more mature integration footprints.

Autonomous credential governance. The vault_creds_renewal workflow running every 8 hours represents a sophisticated, fully autonomous secret lifecycle. It checks token TTL via 1Password, creates an orphaned token via Vault API, updates the Blink connection, and syncs back to 1Password — all without human intervention. 120 executions over 12 months means this has reliably prevented at least 120 potential automation outages from credential expiry.

On-call propagation at scale. Pushing the SecOps on-call identity to five separate Teams channel topics plus a Slack group — every hour — is operationally significant. 585 executions with no manual involvement means the on-call channel topic has never been stale during business hours.

AI-first architecture emerging. Multiple workflows use Blink AI agents (agents.*) as reasoning steps — for sprint planning assistance, CVE summarization, SentinelOne version resolution, and prompt-driven workflow orchestration. The jira_automation_rule_triggering_blinkops_ai and AI_based_workflow_choose_and_execute_from_prompt patterns indicate investment in an agentic SecOps model where natural language drives automation selection.

Gaps & Opportunities

SentinelOne upgrade pipeline has begun activating. Staggered upgrade testing has started (sentinelone_stagger_test_report: 4 runs, sentinelone_staggered_based_agent_upgrade: 2 runs), alongside a new high-volume agent activity webhook (sentinelone_agent_activity_update: 1,112 runs) and a weekly dashboard email report (17 runs) that give SecOps ongoing visibility. The bulk upgrade initiation and task-status-tracking playbooks still show 0 executions, so full-scale rollout has not yet followed the successful staggered tests. Converting the validated stagger pattern into a scheduled, group-by-group rollout would realize the remaining endpoint hygiene value.

Rapid7 and Recorded Future libraries are unused. 10 Rapid7 and 5 Recorded Future workflows show 0 executions. These are well-structured (proper inputs/outputs, AI-assisted summaries) but appear to be capabilities built for future use. A defined trigger — such as a Jira CVE ticket label or a new Recorded Future alert — would activate this investment.

Avanan email investigation not triggered. The Avanan workflows exist with multi-step API token generation and AI analysis, but have never executed. This may reflect the integration being in a readiness/standby state pending a phishing incident type, or a missing Jira trigger that routes Avanan alert tickets into this flow.

Guard Detect redaction workflows are passive. Redact and redact_guard_detect_sensitive_data_alerts both sit at 0 executions despite generate_jira_guard_detect_alerts having 131 runs. If Guard Detect alerts contain sensitive data (PII, credentials), these redaction workflows should either fire as part of the alert creation flow or be confirmed as intentionally inactive.

Multiple workspace variants of the same workflow. Several workflows exist in 3–4 workspace variants with nearly identical names (e.g., three get_sentinelOne_latest_version_by_os across workspaces 349f0c7e, c35962f2, 57442628). This fragmentation across workspaces creates maintenance overhead and operational confusion about which is canonical. Consolidating to a single production workspace with a shared library pattern would reduce duplication.

Integration Ecosystem Map