Library / Security & Compliance
Security & Compliance
Triage CrowdStrike Detections with Jira and Slack
On a schedule, it fetches recent CrowdStrike detections, looks up file hashes for indicators, creates Jira tickets and alerts Slack.
What it does
# Analyze_Crowdstrike_Detectionssearch_for_IOCs_in_VirusTotalcreate_a_ticket_in_Jira_and_post_a_message_in_Slack ## Overview Automated workflow: Analyze_Crowdstrike_Detectionssearch_for_IOCs_in_VirusTotalcreate_a_ticket_in_Jira_and_post_a_message_in_Slack. This workflow integrates 10 different services: itemLists, httpRequest, stickyNote, wait, scheduleTrigger. It contains 27 nodes and follows best practices for error handling and security. ## Workflow Details - Total Nodes: 27 - Node Types: 10 - Error Handling: ✅ Implemented - Security: ✅ Hardened (no sensitive data) - Documentation: ✅ Complete ## Node Breakdown - Schedule Trigger: scheduleTrigger - Split out detections: itemLists - Get recent detections from Crowdstrike: httpRequest - Get detection details: httpRequest - Split out behaviours: itemLists - Look up SHA in Virustotal: httpRequest - Look up IOC in Virustotal: httpRequest - Split In Batches: splitInBatches - Merge behaviour descriptions: itemLists - Set behaviour descriptions: set - ... and 17 more nodes ## Usage Instructions 1. Configure Credentials: Set up all required API keys and credentials 2. Update Variables: Replace any placeholder values with actual data 3. Test Workflow: Run in test mode to verify functionality 4. Deploy: Activate the workflow for production use ## Security Notes - All sensitive data has been removed or replaced with placeholders - Error handling is implemented for reliability - Follow security best practices when configuring credentials ## Troubleshooting - Check error logs if workflow fails - Verify all credentials are properly configured - Ensure all required services are accessible
The steps
- Schedule Trigger
- Split out detections
- Get recent detections from Crowdstrike
- Get detection details
- Split out behaviours
- Look up SHA in Virustotal
- Look up IOC in Virustotal
- Split In Batches
- Merge behaviour descriptions
- Set behaviour descriptions
- Create Jira issue
- Post notification on Slack
- Pause 1 second
- Error Handler
51 steps in total.
Similar automations
Security & ComplianceCheck CrowdStrike Detections in VirusTotal, Alert Slack13 stepsAI Agents & AssistantsTriage Shopify refund and fraud requests with Gemini, Sightengine, Jira and Slack19 stepsAI Agents & AssistantsTriage PHP security advisories with GitHub, Gemini, Jira, Slack and Sheets21 stepsSecurity & ComplianceNotify Slack of Quarantined Emails and Open Jira Tickets10 steps