Before
Security or service desk staff likely had to review recently resolved ServiceNow incidents, locate the matching CrowdStrike detections, and compare the incident status with the detection record. They then had to copy close details and manually update each detection to reflect the resolved incident.
How it works
- Retrieve recently updated ServiceNow incidents during the scheduled run.
- Evaluate each incident and continue only with incidents identified as resolved or closed.
- Update the matching CrowdStrike detection with the incident details and close-related settings.
Workflow details
- Scheduled retrieval: At the scheduled run, the workflow calculates the previous day's date and retrieves recently updated incident records from ServiceNow.
- Incident evaluation: It iterates through the returned incidents and evaluates each one to identify incidents that have been resolved or closed.
- Detection matching: For every qualifying incident, the workflow uses the associated CrowdStrike detection identifier to target the corresponding security detection.
- Automated update: The matching detection is updated with the incident's close code and comments, while its state, assignee, and visibility are modified so it can be treated as closed.
- Operational result: The ServiceNow resolution becomes the trigger for closing the related CrowdStrike detection during the scheduled batch, with no manual cross-system update step shown in the workflow.
What changed
Resolved incidents are reconciled with their corresponding detections automatically during the scheduled batch. The workflow performs the cross-system lookup and detection update without requiring a person to repeat the same status comparison and closure actions for each incident.
Work removed
Reviewing resolved incidents one by one, locating the corresponding detection by identifier, copying close codes and comments, and manually changing the detection state, assignee, and visibility.
Expected outcome
At least one manual cross-system review and detection update is removed for each matched resolved incident, with processing configured for up to four incidents concurrently.
