Zum Inhalt springen
NEUMarktplatz und trig8n Agent: Verkaufen Sie, was Sie bauen, und erhalten Sie Pläne und Änderungen, die getestet sind, bevor Sie sie sehen. Neuigkeiten ansehen

Bibliothek / Sicherheit & Compliance

Sicherheit & Compliance

CrowdStrike-Erkennungen mit Jira und Slack triagieren

Zeitgesteuert ruft es aktuelle CrowdStrike-Erkennungen ab, sucht Datei-Hashes für Indikatoren, erstellt Jira-Tickets und benachrichtigt Slack.

Was sie bewirkt

# Analyze_Crowdstrike_Detectionssearch_for_IOCs_in_VirusTotalcreate_a_ticket_in_Jira_and_post_a_message_in_Slack ## Overview Automated workflow: Analyze_Crowdstrike_Detectionssearch_for_IOCs_in_VirusTotalcreate_a_ticket_in_Jira_and_post_a_message_in_Slack. This workflow integrates 10 different services: itemLists, httpRequest, stickyNote, wait, scheduleTrigger. It contains 27 nodes and follows best practices for error handling and security. ## Workflow Details - Total Nodes: 27 - Node Types: 10 - Error Handling: ✅ Implemented - Security: ✅ Hardened (no sensitive data) - Documentation: ✅ Complete ## Node Breakdown - Schedule Trigger: scheduleTrigger - Split out detections: itemLists - Get recent detections from Crowdstrike: httpRequest - Get detection details: httpRequest - Split out behaviours: itemLists - Look up SHA in Virustotal: httpRequest - Look up IOC in Virustotal: httpRequest - Split In Batches: splitInBatches - Merge behaviour descriptions: itemLists - Set behaviour descriptions: set - ... and 17 more nodes ## Usage Instructions 1. Configure Credentials: Set up all required API keys and credentials 2. Update Variables: Replace any placeholder values with actual data 3. Test Workflow: Run in test mode to verify functionality 4. Deploy: Activate the workflow for production use ## Security Notes - All sensitive data has been removed or replaced with placeholders - Error handling is implemented for reliability - Follow security best practices when configuring credentials ## Troubleshooting - Check error logs if workflow fails - Verify all credentials are properly configured - Ensure all required services are accessible

Die Schritte

  1. Schedule Trigger
  2. Split out detections
  3. Get recent detections from Crowdstrike
  4. Get detection details
  5. Split out behaviours
  6. Look up SHA in Virustotal
  7. Look up IOC in Virustotal
  8. Split In Batches
  9. Merge behaviour descriptions
  10. Set behaviour descriptions
  11. Create Jira issue
  12. Post notification on Slack
  13. Pause 1 second
  14. Error Handler

Insgesamt 51 Schritte.

Ähnliche Automatisierungen