Before
Analysts likely had to retrieve detection details, inspect behaviors, remove duplicate events, and decide which investigative actions to perform. They also had to move between endpoint response, file reputation searches, and ServiceNow while manually creating or updating the incident and copying investigation results into it.
How it works
- Receive the detection, retrieve its details, simplify the data, and evaluate the response conditions.
- Create or update the ServiceNow incident while conditionally containing the device and enriching the investigation with behavior, extension, memory, and hash evidence.
- Remove containment when the applicable condition is met and write the final response details back to the incident.
Workflow details
- Detection intake and preparation: The workflow starts when a detection arrives through an email trigger, retrieves the available detection information, simplifies individual detections, and evaluates routing conditions.
- Initial response and ticketing: Based on the detection conditions, the workflow either creates a ServiceNow ticket or sends a containment request for the affected device, then records the response in the incident ticket.
- Behavior analysis: CrowdStrike behaviors are broken down and duplicate events are removed so that subsequent investigation is based on more organized detection data.
- Evidence enrichment: Conditional branches extract Chrome extensions or memory information, parse extension results, and search both the detected file hash and its parent hash in VirusTotal. The resulting evidence is added to the ServiceNow incident.
- Containment completion and case updates: When the relevant condition is met, the workflow removes containment from the device and performs a final ServiceNow update with the available investigation and response details.
What changed
Detection response becomes a coordinated workflow rather than a sequence of separate analyst tasks. Conditional routing, endpoint containment actions, evidence lookups, deduplication, and repeated ServiceNow updates happen automatically, with investigation results captured in the incident as the workflow progresses.
Work removed
Retrieving and reformating detection details, reviewing behaviors one by one, removing duplicate events, checking routing conditions, creating or updating ServiceNow incidents, sending containment and removal requests, extracting extension or memory evidence, searching file and parent hashes, parsing results, and copying findings into the incident record.
Expected outcome
Depending on the selected branches, each qualifying detection can remove a double-digit set of recurring analyst actions, with the incident enriched and response status recorded without repeated manual system changes.
