Skip to main content
Download the Buyer’s Guide for Cyber Risk Quantification Solutions
Download Guide
Request a Demo

Customer Story: Large U.S. Health System – Phishing Automation and Bulk Importing and Enrichment of Indicators

Company Type:
Hospital System


Company Size:
50 Hospitals across 7 states



This large, multi-state health system’s major challenges involved automating Threat Intelligence collection, IOC enrichment, creating workflow templates, and improving Case Management. The main use cases were around phishing automation and bulk importing and enrichment of indicators (using VirusTotal) and specific scoring criteria based on VirusTotal results.


ThreatConnect’s intelligence-driven SOAR capabilities made it possible for the security team to create repeatable playbooks, automated processes and structured workflows that enabled SecOps teams to reduce the number of manual steps they must perform during their day-to-day responsibilities. There were nearly a dozen tool integrations involved in this ThreatConnect solution.


By deploying ThreatConnect, the client was able to:

  • Automate Phishing Attack Response:
    • Using Playbooks (ThreatConnect’s Orchestration and Automation Capability), the security team automated Phishing Analysis, Triage, and Response, reducing the time it took from more than 3 hours to just minutes.
  • Automate Threat Intelligence Collection: 
    • ThreatConnect’s Threat Intelligence Platform (TIP) functionality enabled the security team to automate the collection from their various intel sources, both internal and external.
  • Conduct IOC Enrichment: 
    • A Playbook was built that allowed the security team to eliminate their painful, time consuming process of trying to understand what thousands of IOCs meant to their enterprise.
  • Improve Case Management: 
    • By enabling Workflow, the security team was able to create templates and standardize their course of action for Phishing Triage and Response.