Before
Security analysts likely searched for relevant detections, opened and updated their details, extracted file indicators, and checked each indicator in a separate reputation service. For confirmed malicious files, they then had to copy alert information into a Jira ticket and manually notify a Slack channel.
How it works
- Retrieve and prepare matching security detections, including their available details and extracted indicators.
- Check each file indicator for malicious status and automatically choose the appropriate branch.
- Create a Jira incident ticket and send a Slack summary for malicious indicators, or complete successfully when no malicious result is found.
Workflow details
- Detection collection: The workflow retrieves matching detections from CrowdStrike, obtains their details, and updates the detection information before further analysis.
- IOC extraction: It transforms the updated detection data to identify the file indicators of compromise that require reputation checks.
- Malware validation: Each extracted file indicator is evaluated through a VirusTotal file report, and the workflow branches automatically based on whether the file is identified as malicious.
- Incident creation: When an indicator is malicious, the workflow creates a Bug issue in the configured Jira project with alert, type, name, and date information.
- Team notification: After creating a Jira issue, it sends a process summary to a Slack channel; non-malicious indicators proceed directly to successful completion.
What changed
Detection analysis now proceeds automatically from alert retrieval through IOC extraction and maliciousness validation. Confirmed malicious indicators are handed off immediately through a Jira ticket and Slack notification, while non-malicious indicators are resolved without unnecessary ticket creation.
Work removed
Searching detections one by one, opening and updating detection information, extracting file indicators, checking each file in VirusTotal, copying alert details into Jira, creating incident tickets, and manually posting process summaries in Slack.
Expected outcome
The workflow can conservatively remove up to four recurring manual actions per IOC—reputation lookup, maliciousness assessment, ticket creation, and team notification—while ensuring confirmed malicious indicators receive documented follow-up.
