Overview
This workflow automates the end-to-end process of analyzing security detections from Crowdstrike, enriching them with Virustotal intelligence, and orchestrating incident response through Jira and Slack.
Key Features
- Scheduled Detection Retrieval: Regularly triggers to fetch recent detections from Crowdstrike.
- IOC Enrichment: Automatically extracts and analyzes indicators of compromise (IOCs) using Virustotal APIs for SHA and other IOCs.
- Incident Ticketing: Creates detailed Jira tickets for actionable detections, ensuring incidents are tracked and managed.
- Real-Time Notifications: Posts summary messages to Slack channels, keeping security teams informed instantly.
- Batch Processing: Efficiently handles multiple detections and behaviors using batch and split nodes.
Benefits
- Accelerates Threat Response: Reduces manual investigation time by automating IOC enrichment and ticket creation.
- Improves Accuracy: Ensures consistent, thorough analysis and documentation of each detection.
- Enhances Collaboration: Integrates with Slack and Jira to streamline communication and incident management.
Use Cases
- Security operations centers (SOCs) seeking to automate threat triage.
- Organizations aiming to reduce mean time to response (MTTR) for security incidents.
- Teams needing integrated alerting and ticketing for cybersecurity workflows.
