Before
Security staff likely had to review detected behaviors individually, retrieve additional detection details, remove duplicate events, and check process hashes in a separate reputation database. For findings that met the reporting condition, they then had to compile the evidence, create a Jira issue, and notify the response team in Microsoft Teams.
How it works
- Collect and prepare detected behaviors by retrieving detection details, breaking the data into individual behaviors, removing duplicates, and controlling processing volume.
- Check each process SHA256 against VirusTotal and evaluate whether the validation condition requires escalation.
- Consolidate qualifying findings, create a Jira issue, and send a Teams notification; otherwise, complete the workflow without escalation.
Workflow details
- Detection collection: An email-triggered workflow retrieves detected behaviors from CrowdStrike, breaks the detection data into manageable records, and obtains additional details for each detection.
- Event preparation: The workflow removes duplicate events, separates detections into individual behaviors, and applies rate limiting before continuing analysis.
- Reputation validation: Each process SHA256 is checked against VirusTotal to determine whether the value exists or matches the relevant record in its database.
- Escalation decision: When the validation condition is met, the related behaviors are consolidated into a unified security finding for reporting; otherwise, the workflow consolidates the data and ends successfully without creating an escalation.
- Security reporting: For qualifying findings, the workflow creates a Jira issue and sends an adaptive message to a Microsoft Teams chat, giving the response team both a tracked work item and an operational notification.
What changed
Detection analysis, duplicate removal, hash validation, and escalation routing now happen automatically after the email trigger. Qualifying findings are converted directly into a tracked Jira issue and a Teams message, while non-qualifying findings are closed through the workflow without a manual reporting handoff.
Work removed
Reviewing detections one by one, retrieving detection details, deduplicating events, breaking detections into individual behaviors, checking process SHA256 values in VirusTotal, consolidating evidence, creating Jira issues, and manually notifying the response team in Microsoft Teams.
Expected outcome
A conservative expectation is that each qualifying detection removes at least three recurring manual actions—hash lookup, report preparation, and cross-tool notification—while ensuring that non-qualifying detections are filtered before escalation.
