monday.com — Customer Success Report

1. Identity Threat Detection & Response

Description: Automated investigation and response to identity-based threats across Okta, LastPass, and Slack. Each playbook handles a specific alert type — enriching context, querying threat intelligence, asking the analyst a single scoped question via Slack, and closing or escalating the case.

Business problem solved: Security analysts are overwhelmed with identity alerts that are individually low-effort but collectively high-volume. This suite eliminates manual triage for common Okta/SaaS identity threat patterns, routing only true positives requiring human judgment.

Integrations: Okta, Splunk, VirusTotal, Slack, PagerDuty, monday.com (case mgmt)

Category: SOC | Subcategory: Identity threat response

2. Case Management & Alert Routing

Description: Orchestrates the full lifecycle of a security alert inside monday.com as the case management platform — routing alerts to the correct handler, managing severity escalation and de-escalation, creating comments, assigning ownership, and raising PagerDuty incidents for critical cases.

Business problem solved: Security alerts arriving via monday.com webhooks need to be triaged, assigned, and tracked without manual ticket management. This use case replaces analyst toil with an automated dispatch layer that mirrors what a Tier-1 SOC analyst does in the first 10 minutes of alert triage.

Integrations: monday.com, PagerDuty, Slack

Category: SOC | Subcategory: Case mgmt & SOAR

3. Alert Enrichment & IOC Lookup

Description: Supporting workflows that extract observables (IPs, users, devices) from raw alert payloads, check IPs against known internal address ranges, and process alerts that lack a matching detection template.

Business problem solved: Reduces the time analysts spend manually extracting indicators from raw log data and normalising them for downstream workflows.

Integrations: Blink internal tables, Splunk, Python

Category: SOC | Subcategory: Alert enrichment / IOC lookup

4. Threat Intelligence & Watchlist Management

Description: Maintains an internal watchlist of high-risk users, checks each incoming alert against that list, and automatically elevates handling priority when a watchlisted user appears. New users can be added to the watchlist as an outcome of other investigation workflows.

Business problem solved: Analysts lose track of users who appeared in prior investigations. This use case creates a persistent, automated risk memory — ensuring repeat offenders or known-bad actors are flagged on every subsequent alert, without manual cross-referencing.

Integrations: Blink internal tables, monday.com (case mgmt)

Category: SOC | Subcategory: Threat intel ingest & curation

5. Privileged Access Management

Description: Detects and investigates privilege-grant events for users outside the IT department. Validates whether a grant is legitimate by cross-referencing HR ticket data and Okta user attributes, then requests analyst approval or auto-closes depending on context.

Business problem solved: Privilege creep is a top IAM risk. This use case ensures that every privilege elevation for a non-IT user receives at minimum automated scrutiny, and that suspicious grants surface to a human before becoming a standing access risk.

Integrations: Okta, Slack, Blink internal tables

Category: IAM | Subcategory: Privileged account mgmt

6. SaaS Administration

Description: Automates ownership and governance operations within the monday.com platform itself — specifically transferring all board ownerships from one user to another, an operation typically triggered by offboarding or role changes.

Business problem solved: Manually reassigning board ownership during employee transitions is time-consuming and error-prone. This workflow automates the end-to-end transfer, validating both source and destination users via Okta and monday.com before executing the change.

Integrations: monday.com, Okta

Category: Other | Subcategory: SaaS / IT administration

Infrastructure & Shared Subflows

These are internal building blocks called by the use-case workflows above. They are excluded from KPI counts.

Category: SOC | Subcategory: Case mgmt & SOAR (internal utilities)

Strengths

• Deep Okta coverage. The workspace contains 11 distinct Okta threat-response playbooks covering the most common identity attack patterns: MFA bypass, session impersonation, account takeover, TOR-IP activity, proxy authentication, policy modification, API token creation, and admin portal access. This is production-ready identity threat response automation.

• Cohesive SOAR architecture. monday.com serves a dual role as both a SIEM-adjacent alert source (via webhooks) and as the case management backbone. The shared subflow pattern (Assign Security Automation Bot → Get Monday Sub-Items → Create Comment → Change Status) is consistent and reusable across all 17 identity threat playbooks.

• Multi-source identity context. Investigation playbooks routinely pull context from Splunk (historical search), Okta (user profile, group membership), and VirusTotal (IP reputation) before deciding whether to escalate or auto-close. This enrichment depth reduces false-positive analyst interruptions.

• User watchlist capability. The add/check watchlist pattern creates a persistent risk memory across unrelated alert investigations — a differentiating capability that most SOAR deployments lack.

• Feedback loop for severity. Dedicated raise/decrease severity playbooks with audit comments create an auditable severity lifecycle, critical for compliance-conscious security programs.

Gaps

• Zero recorded executions. All 39 workflows show 0 runs in the last 12 months. This suggests either the alert pipeline has not been fully connected to the Blink trigger layer, or execution logging was not enabled during the capture window. The highest-priority next step is confirming webhook connectivity from the monday.com alert board to the Main Alert Switch.

• No EDR coverage. The workspace has no endpoint detection or response workflows. Given the depth of identity coverage, adding CrowdStrike or SentinelOne containment playbooks is the natural extension.

• No cloud/SaaS misconfiguration coverage. Despite monday.com being a cloud-native company, there are no CSPM, cloud config audit, or SaaS policy workflows. AWS/GCP/Azure and Salesforce/Google Workspace posture automation would add a second major use-case pillar.

• LastPass coverage is thin. Only two LastPass playbooks exist (TOR IP and Master Password Changed by Admin). LastPass is a high-value target; expanding to cover credential breach events and suspicious export activity would be valuable.

• No phishing response. There is no email/phishing triage or response automation. Phishing is typically the highest-volume alert category in a corporate SOC and is absent here.

Integration Ecosystem