Skip to content
NEWMarketplace and the trig8n Agent: sell what you build, and get plans and changes that are tested before you see them. See what is new

Library / Security & Compliance

Security & Compliance

Triage CrowdStrike Detections with Jira and Slack

On a schedule, it fetches recent CrowdStrike detections, looks up file hashes for indicators, creates Jira tickets and alerts Slack.

What it does

# Analyze_Crowdstrike_Detectionssearch_for_IOCs_in_VirusTotalcreate_a_ticket_in_Jira_and_post_a_message_in_Slack ## Overview Automated workflow: Analyze_Crowdstrike_Detectionssearch_for_IOCs_in_VirusTotalcreate_a_ticket_in_Jira_and_post_a_message_in_Slack. This workflow integrates 10 different services: itemLists, httpRequest, stickyNote, wait, scheduleTrigger. It contains 27 nodes and follows best practices for error handling and security. ## Workflow Details - Total Nodes: 27 - Node Types: 10 - Error Handling: ✅ Implemented - Security: ✅ Hardened (no sensitive data) - Documentation: ✅ Complete ## Node Breakdown - Schedule Trigger: scheduleTrigger - Split out detections: itemLists - Get recent detections from Crowdstrike: httpRequest - Get detection details: httpRequest - Split out behaviours: itemLists - Look up SHA in Virustotal: httpRequest - Look up IOC in Virustotal: httpRequest - Split In Batches: splitInBatches - Merge behaviour descriptions: itemLists - Set behaviour descriptions: set - ... and 17 more nodes ## Usage Instructions 1. Configure Credentials: Set up all required API keys and credentials 2. Update Variables: Replace any placeholder values with actual data 3. Test Workflow: Run in test mode to verify functionality 4. Deploy: Activate the workflow for production use ## Security Notes - All sensitive data has been removed or replaced with placeholders - Error handling is implemented for reliability - Follow security best practices when configuring credentials ## Troubleshooting - Check error logs if workflow fails - Verify all credentials are properly configured - Ensure all required services are accessible

The steps

  1. Schedule Trigger
  2. Split out detections
  3. Get recent detections from Crowdstrike
  4. Get detection details
  5. Split out behaviours
  6. Look up SHA in Virustotal
  7. Look up IOC in Virustotal
  8. Split In Batches
  9. Merge behaviour descriptions
  10. Set behaviour descriptions
  11. Create Jira issue
  12. Post notification on Slack
  13. Pause 1 second
  14. Error Handler

51 steps in total.

Similar automations