CrowdStrike Falcon - False Positive Incident Handling

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike case or detection that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it.

CrowdStrike Falcon · 21 tasks · 7 inputs · 0 outputs

Inputs

  • AutoUnisolation — Whether automatic un-isolation is allowed.
  • HostId — The host ID to unisolate.
  • AllowIOCTagName — The tag name to apply to the allowed indicator.
  • ApplyAllowIOCGlobally — Whether the indicator is globally added to the allow list. If 'false', specify the group name for the AllowHostGroup input.
  • AllowHostGroupName — The name of the allow list group to apply if ApplyAllowIOCGlobally is set to 'false'.
  • CloseNotes — The close notes to be listed in CrowdStrike.
  • Sha256 — The SHA256 value to manage.

Commands used

cs-falcon-add-case-tag cs-falcon-resolve-case cs-falcon-resolve-detection cs-falcon-upload-custom-ioc setIndicators

Flowchart

No Yes detection ngsiem_case yes Globally Host Group yes yes yes yes Start Start Unisolate host Unisolate host Approve unisolation Approve unisolation Done False Positive Done False Positive False positive detection or case closing False positive detection ... Allow indicators Allow indicators Allow IOC globally - cs-falcon-upload-custom-ioc Allow IOC globally cs-falcon-upload-custom-ioc Resolve CS case - cs-falcon-resolve-case Resolve CS case cs-falcon-resolve-case Resolve CS detection - cs-falcon-resolve-detection Resolve CS detection cs-falcon-resolve-detection Which indicator should be added to the allow list? Which indicator should be... Was this a detection or a case? Was this a detection or a... Is auto unisolation allowed? Is auto unisolation allowed? Crowdstrike Falcon - Unisolate Endpoint - Crowdstrike Falcon - Unisolate Endpoint Crowdstrike Falcon - Unis... Crowdstrike Falcon - Unisolat... Tag Indicators - setIndicators Tag Indicators setIndicators Tag Tag Allow on EDR Allow on EDR Is IOC allowed to be added globally? Is IOC allowed to be adde... Allow IOC for group - cs-falcon-upload-custom-ioc Allow IOC for group cs-falcon-upload-custom-ioc Were values provided? Were values provided? Add CS case tag - cs-falcon-add-case-tag Add CS case tag cs-falcon-add-case-tag is CrowdStrike Falcon integration enabled? - IsIntegrationAvailable is CrowdStrike Falcon int... IsIntegrationAvailable