Before
Analysts likely had to search for the detection, open its full details, verify that it came from the relevant alert source, and manually contain the affected device. They then had to copy alert and device information into a Jira task, coordinate any later release of the device, and update the case with the containment history.
How it works
- Receive the detection, find its details, and verify that it matches the Falcon Overwatch alert criteria.
- Contain the identified device automatically and confirm whether the containment request returned the expected success response.
- Create a detailed Jira task and provide an analyst-invoked reversal link that lifts containment and records the change in the case.
Workflow details
- Detection intake and enrichment: The workflow starts when CrowdStrike Falcon Overwatch detection data arrives through an email trigger. It searches for the relevant detection ID and retrieves detailed alert, device, behavior, severity, confidence, network, operating system, and file information.
- Alert validation: The workflow checks whether the detection matches the Falcon Overwatch tactic identifier. Only matching alerts proceed to the containment action, while other alerts do not follow the standard containment path.
- Automated containment: For a qualifying detection, the affected device is contained automatically using its device identifier. The workflow then checks the containment response and treats the expected 202 response as confirmation that the action was accepted.
- Incident handoff: After successful containment, the workflow creates a Jira task containing the alert timestamp, detection ID, hostname, severity, device identifiers, network details, platform information, and observed behavior. The task also records that the offending device was contained and includes an action link for cancelling containment.
- Controlled reversal and logging: When an analyst invokes the cancellation action from the Jira task, the workflow lifts containment on the device and adds a comment documenting that containment was initially applied and later removed. This preserves the operational history for subsequent analysts.
What changed
A qualifying detection now triggers validation, device containment, and Jira case creation without requiring an analyst to perform each handoff. The human decision is limited to invoking the provided reversal action when containment should be lifted, after which the workflow updates the Jira record automatically.
Work removed
Repeated detection searches, manual alert-detail lookups, source and response-code checks, device containment requests, copying of alert and host information into Jira, manual case creation, and manual containment-status comments are removed for qualifying alerts.
Expected outcome
For each qualifying alert, the workflow can conservatively remove at least five routine analyst actions while producing a documented containment case and a traceable reversal path.
