Who is this workflow for? This n8n workflow automates the processing of security detections from CrowdStrike by searching for Indicators of Compromise (IOCs) in VirusTotal, creating corresponding tickets in Jira, and notifying your team via Slack. Streamline your incident response and maintain efficient communication with this integrated solution..

What does this workflow do?

  • Trigger: The workflow is scheduled to run daily at midnight using the Schedule Trigger node.
  • Fetch Detections: An HTTP Request node retrieves recent security detections from CrowdStrike.
  • Split Detections: The response is divided into individual detections for parallel processing.
  • Enrich Detections: Each detection is enhanced by querying the CrowdStrike API for additional details using another HTTP Request node.
  • Batch Processing: The Split In Batches node processes detections sequentially to manage load.
  • VirusTotal Lookup:
  • SHA256 Query: One HTTP Request node searches VirusTotal using SHA256 hashes.
  • IOC Query: Another HTTP Request node searches VirusTotal using IOC values.
  • Rate Limiting: A Wait node introduces a 1-second pause between requests to avoid API rate limits.
  • Set Fields: Relevant details from CrowdStrike and VirusTotal, such as detection links, confidence scores, filenames, and usernames, are populated into the workflow.
  • Concatenate Details: An Item Lists node combines the collected information for each detection.
  • Create Jira Issues: For each enriched detection, a Jira issue is created with a summary that includes CrowdStrike alert severity and hostnames, and a detailed description incorporating data from both CrowdStrike and VirusTotal.
  • Send Slack Notification: Information about each Jira issue is sent as a Slack message to designated team members for immediate awareness and action.

🤖 Why Use This Automation Workflow?

  • Efficiency: Automates repetitive tasks, reducing manual effort and speeding up response times.
  • Integration: Seamlessly connects multiple tools (CrowdStrike, VirusTotal, Jira, Slack) for a unified workflow.
  • Accuracy: Enhances detection analysis by enriching data with detailed information from VirusTotal.
  • Notification: Keeps your team informed in real-time through Slack messages.

👨‍💻 Who is This Workflow For?

This workflow is designed for security analysts, IT teams, and incident response professionals who manage and respond to security alerts. It is ideal for organizations seeking to enhance their security operations with automated processes and integrated toolchains.

🎯 Use Cases

  1. Incident Response Automation: Automatically process and investigate security alerts, reducing the time from detection to action.
  2. Threat Intelligence Enrichment: Enrich security detections with detailed IOC information from VirusTotal to improve decision-making.
  3. Team Notification and Collaboration: Instantly notify relevant team members about new security incidents through Slack, ensuring timely collaboration.

TL;DR

This n8n workflow streamlines your security incident management by automating the retrieval and enrichment of CrowdStrike detections, creating actionable Jira tickets, and notifying your team via Slack. Implementing this workflow enhances your incident response efficiency and ensures timely communication across your security operations.

Get started with n8n
Need help with n8n?

Related

Automate Image Distribution via Telegram with n8n

Streamline image sharing on Telegram with n8n. Automate tasks, enhance efficiency, and leverage powerful integration features. 

  • 623
  • 20

Retrieve All Leads from Zoho CRM Using n8n

Automate lead retrieval, saving time by integrating Zoho CRM with n8n. Streamline your process with real-time updates and easy configuration. 

  • 503
  • 20

Integrate Shopify Customer Data with HubSpot Contacts

Automate customer data integration for seamless updates between Shopify and HubSpot. Eliminate manual entry and ensure data consistency effortlessly. 

  • 610
  • 17

Help us find the best n8n templates

About

A curated directory of the best n8n templates for workflow automations.

Navigation

Submit