Automated Threat Detection Analysis and Incident Response with Crowdstrike, Viru

Overview

This workflow automates the end-to-end process of analyzing security detections from Crowdstrike, enriching them with Virustotal intelligence, and orchestrating incident response through Jira and Slack.

Key Features

• Scheduled Detection Retrieval: Regularly triggers to fetch recent detections from Crowdstrike.
• IOC Enrichment: Automatically extracts and analyzes indicators of compromise (IOCs) using Virustotal APIs for SHA and other IOCs.
• Incident Ticketing: Creates detailed Jira tickets for actionable detections, ensuring incidents are tracked and managed.
• Real-Time Notifications: Posts summary messages to Slack channels, keeping security teams informed instantly.
• Batch Processing: Efficiently handles multiple detections and behaviors using batch and split nodes.

Benefits

• Accelerates Threat Response: Reduces manual investigation time by automating IOC enrichment and ticket creation.
• Improves Accuracy: Ensures consistent, thorough analysis and documentation of each detection.
• Enhances Collaboration: Integrates with Slack and Jira to streamline communication and incident management.

Use Cases

• Security operations centers (SOCs) seeking to automate threat triage.
• Organizations aiming to reduce mean time to response (MTTR) for security incidents.
• Teams needing integrated alerting and ticketing for cybersecurity workflows.