CrowdStrike Detection Analysis: VT IOC Search, Jira Tickets & Slack Alerts

This n8n workflow automates security incident handling from CrowdStrike detections. Triggered daily at midnight via Schedule Trigger, it fetches recent detections using HTTP Request to CrowdStrike API, splits them into individual items, and enriches each with detailed info from another CrowdStrike API call. Processing occurs sequentially via Split In Batches to manage load.

Next, it queries VirusTotal for behavioral data using SHA256 hashes and IOC values through two HTTP Requests, incorporating a 1-second Wait node to avoid rate limiting. Data from CrowdStrike and VirusTotal is then consolidated using Set nodes and Item Lists, capturing key details like detection links, confidence scores, filenames, and usernames.

Finally, for each detection, it creates a Jira issue with severity-based summaries, hostnames, and enriched descriptions, then posts a Slack message to notify users. Benefits include streamlined incident response, reduced manual effort, and proactive threat hunting. Ideal for security teams in IT environments needing automated triage of alerts from EDR tools.

Use cases: Daily security monitoring in enterprises, integrating threat intel platforms like VirusTotal with ITSM (Jira) and collaboration (Slack). Handles potential issues like API rate limits and timezone configs for reliable operation.