Before
An operator likely had to search for the target host, identify its endpoint details, select and run the appropriate response command, and monitor the session manually. They then had to gather the command output, check for errors or completion, format the result, and post updates in Slack.
How it works
- Find the available endpoint and present the supported real-time response commands and host choices for selection.
- Initialize a response session, run the selected command on the chosen host or hosts, and verify completion and error status.
- Format the response and execution logs into Slack messages, with an optional cleanup of the earlier interaction message.
Workflow details
- Request and selection: An emailhook-triggered execution starts the workflow, which searches the CrowdStrike environment for available hosts and presents hostnames and supported commands such as env, ipconfig, memdump, netstat, ps, and shutdown for selection in Slack.
- Session setup: After the user selects a command and machine, the workflow initializes a CrowdStrike real-time response batch session and allows offline hosts to be queued for execution.
- Command execution: The selected command is submitted to the batch session for the chosen hosts with a defined execution timeout and persistent result collection.
- Validation and reporting: The workflow checks whether the session is initialized, whether execution is complete, and whether the command response contains errors before continuing with reporting.
- Slack delivery: It formats the command response and execution details into Slack Block Kit content, posts completion and log messages to the configured channel, and can remove a previous Slack message when appropriate.
What changed
The endpoint lookup, command submission, session checks, completion validation, error check, and Slack reporting now occur in one guided workflow. Analysts still choose the command and target host, while the automation handles execution and delivers the formatted result to the configured channel.
Work removed
Searching for endpoint records, copying host identifiers, manually initiating the response session, submitting the command, checking completion and errors, collecting execution logs, formatting the output, and posting status updates in Slack.
Expected outcome
Each request is expected to remove roughly five recurring manual handoffs, while providing a consistent Slack record of the selected command, execution status, and response.
