Before
Security personnel likely had to review each SIEM alert, create an incident record in Airtable, and then switch to the endpoint security system to search for the affected host. They also had to initiate device containment manually after identifying the correct hostname.
How it works
- Receive a new alert from the SIEM and create a corresponding security incident record in Airtable.
- Search for the affected endpoint by hostname in the endpoint security platform.
- Contain the identified device to begin the response action.
Workflow details
- Alert intake: The workflow starts when a new security alert is received from a SIEM webhook, providing the event that initiates the incident-handling process.
- Incident recording: For each alert, it creates a security incident record in Airtable, with the option to configure additional database fields for the incident information.
- Host identification: The workflow searches CrowdStrike Falcon for the affected device by hostname so the alert can be associated with the relevant endpoint.
- Device containment: After locating the host, it runs the containment action for that device in CrowdStrike Falcon, helping limit the endpoint's ongoing involvement in the incident.
What changed
Each incoming SIEM alert now starts a connected incident-recording and endpoint-response sequence automatically. The host lookup and containment action occur as workflow steps rather than separate manual handoffs.
Work removed
Manually creating an Airtable incident record, switching tools to search for the affected host by hostname, and initiating device containment for each new SIEM alert.
Expected outcome
Each new alert can produce one incident record and one automated host-containment sequence, removing at least three recurring manual actions per alert: record creation, host lookup, and containment initiation.
