Who is this workflow for? This n8n workflow automates the processing of security detections from CrowdStrike by searching for Indicators of Compromise (IOCs) in VirusTotal, creating corresponding tickets in Jira, and notifying your team via Slack. Streamline your incident response and maintain efficient communication with this integrated solution..

What does this workflow do?

  • Trigger: The workflow is scheduled to run daily at midnight using the Schedule Trigger node.
  • Fetch Detections: An HTTP Request node retrieves recent security detections from CrowdStrike.
  • Split Detections: The response is divided into individual detections for parallel processing.
  • Enrich Detections: Each detection is enhanced by querying the CrowdStrike API for additional details using another HTTP Request node.
  • Batch Processing: The Split In Batches node processes detections sequentially to manage load.
  • VirusTotal Lookup:
  • SHA256 Query: One HTTP Request node searches VirusTotal using SHA256 hashes.
  • IOC Query: Another HTTP Request node searches VirusTotal using IOC values.
  • Rate Limiting: A Wait node introduces a 1-second pause between requests to avoid API rate limits.
  • Set Fields: Relevant details from CrowdStrike and VirusTotal, such as detection links, confidence scores, filenames, and usernames, are populated into the workflow.
  • Concatenate Details: An Item Lists node combines the collected information for each detection.
  • Create Jira Issues: For each enriched detection, a Jira issue is created with a summary that includes CrowdStrike alert severity and hostnames, and a detailed description incorporating data from both CrowdStrike and VirusTotal.
  • Send Slack Notification: Information about each Jira issue is sent as a Slack message to designated team members for immediate awareness and action.

🤖 Why Use This Automation Workflow?

  • Efficiency: Automates repetitive tasks, reducing manual effort and speeding up response times.
  • Integration: Seamlessly connects multiple tools (CrowdStrike, VirusTotal, Jira, Slack) for a unified workflow.
  • Accuracy: Enhances detection analysis by enriching data with detailed information from VirusTotal.
  • Notification: Keeps your team informed in real-time through Slack messages.

👨‍💻 Who is This Workflow For?

This workflow is designed for security analysts, IT teams, and incident response professionals who manage and respond to security alerts. It is ideal for organizations seeking to enhance their security operations with automated processes and integrated toolchains.

🎯 Use Cases

  1. Incident Response Automation: Automatically process and investigate security alerts, reducing the time from detection to action.
  2. Threat Intelligence Enrichment: Enrich security detections with detailed IOC information from VirusTotal to improve decision-making.
  3. Team Notification and Collaboration: Instantly notify relevant team members about new security incidents through Slack, ensuring timely collaboration.

TL;DR

This n8n workflow streamlines your security incident management by automating the retrieval and enrichment of CrowdStrike detections, creating actionable Jira tickets, and notifying your team via Slack. Implementing this workflow enhances your incident response efficiency and ensures timely communication across your security operations.

Get started with n8n
Need help with n8n?

Related

Automate Email Sending with Mailjet and n8n

Streamline your workflow by automating emails with n8n and Mailjet. Save time, ensure consistency, and enhance communication effortlessly. 

  • 483
  • 12

QR Code Coupon Management and Validation Using SuiteCRM

Automate QR coupon management, enhance CRM integration, and ensure secure validation with this efficient n8n SuiteCRM workflow template. 

  • 556
  • 13

Automated YouTube Video Summarization with Transcripts

Streamline video summarization, automate transcripts, and enhance efficiency with this n8n workflow. 

  • 506
  • 25

Help us find the best n8n templates

About

A curated directory of the best n8n templates for workflow automations.

Navigation

Submit