How MSSPs Can Save Thousands of Hours in Their SOAR Implementation with Automated Client Onboarding

For mid and large-sized MSSPs, client onboarding is an important consideration. An entirely manual process can take weeks and exposes you to preventable issues that can delay the project or go unnoticed until a production issue occurs.

D3 Smart SOAR has automated the client onboarding process with a unique application of the Event Playbook. Typically, event playbooks are used to prioritize and correlate incoming alerts. Smart SOAR’s event playbook, however, can also be used to initiate the client onboarding process when a new tenant needs to be created.

The Challenge

All customers come with their own SLAs, primary and secondary contacts, and tools, including connection credentials and threat intel mappings. In addition, SOAR-specific configurations need to be synced, including playbooks, automation rules, and global lists. Setting this up is doable for one or two clients, but when you’re onboarding dozens, or hundreds, the workload can become a serious problem. 

Automated Client Onboarding with Smart SOAR

Through working with some of the largest MSSPs in the world, we’ve learned how to help growing MSSPs simplify this process and we’ve created an automated client onboarding process to assist bigger MSSPs.

Smart SOAR playbook for client onboarding

The workflow is as follows:

  1. A new addition to the MSSP’s ITSM begins the process of onboarding.
  2. The customer’s information is synced to Smart SOAR, including SLAs, shift assignments, and preferred contact methods.
  3. Smart SOAR uses this information to create a new tenant site.
  4. Smart SOAR pushes configurations to that site including playbooks, automation rules, the global list, and more.

The workflow triggers when a new entry is added to a ticketing tool like Zendesk. Typically this include the customer’s:

  1. Region
  2. Organization Name
  3. Contact
  4. Email
  5. Phone
  6. Address

This information is used to set up the client site. Then the onboarding playbook pushes event and incident playbooks, integrations, connections, and other settings to the client site from the master tenant.


With the implementation of Smart SOAR’s automated client onboarding, MSSPs can experience a significant reduction in the time and resources dedicated to onboarding new clients. Instead of taking weeks, the process now takes hours, or even minutes. And this reduction in time doesn’t come at the cost of precision; the automated process is designed to minimize errors and inconsistencies, ensuring a smooth transition for each new client. This way, MSSPs can onboard dozens, or even hundreds, of clients without the process becoming a bottleneck.


By automating a task that was once laborious and time-consuming, MSSPs can focus on what really matters: providing superior cybersecurity solutions to their clients. Smart SOAR’s automated client onboarding revolutionizes the way MSSPs handle new clients, making the process faster, smoother, and more reliable. With automated onboarding, MSSPs are better equipped to scale up their business.

Social Icon
Pierre Noujeim

Pierre Noujeim is a Product Marketing Manager with a cyber security engineering background. Having implemented SOAR at enterprise organizations as well as for D3's MSSP partners, Pierre has rich and varied insight into integrations, use cases and the cyber security vendor landscape. A dedicated product marketer, Pierre represents D3 at analyst briefings, webinar workshops and industry conferences such as RSA and Black Hat.