Before
Analysts likely had to retrieve detection details, extract indicators, and look up each URL, IP address, or hash separately in an intelligence service. They then had to decide which findings to add to a case and manually close cases when the results were not malicious.
How it works
- Retrieve matching CrowdStrike detections, update or obtain their details, extract the indicators, and create a corresponding TheHive case.
- Process each indicator by type, run the appropriate VirusTotal analysis or report lookup, and evaluate whether the result is malicious.
- Add malicious indicators to the case as observables or close the case when the processed result is not malicious.
Workflow details
- Detection preparation: The workflow retrieves matching detections from CrowdStrike, obtains additional detection details, and extracts the incident data and indicators needed for investigation. It then creates a new case in TheHive to hold the investigation outcome.
- Indicator processing: Each indicator of compromise is processed individually. The workflow identifies whether it is a URL, IP address, or hash key and selects the corresponding VirusTotal analysis or report lookup.
- Maliciousness decision: After the VirusTotal result is retrieved, the workflow evaluates whether the indicator is malicious. This creates an automated decision point for separating indicators that require case evidence from those that do not.
- Case handling: Malicious indicators are added to the TheHive case as observables for continued investigation. When an indicator is not malicious, the workflow can close the case instead of leaving it open for manual disposition.
- Iterative coverage: The same enrichment and triage logic continues until all extracted indicators have been processed, helping ensure that the incident is evaluated consistently across its available observables.
What changed
IOC enrichment and the first case-routing decision now occur automatically for every extracted indicator. TheHive receives malicious findings as observables, while non-malicious results can be closed without a separate manual handoff.
Work removed
Retrieving detection details, extracting URLs, IP addresses, and hash keys, switching to an intelligence lookup for each IOC, reviewing maliciousness results, adding malicious indicators to a case, and manually closing non-malicious cases.
Expected outcome
For each IOC processed, the workflow can remove at least one manual intelligence lookup and one manual case-routing action, with consistent coverage across all extracted indicators.
