CrowdStrike Falcon - Get Detections by Case

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID.

CrowdStrike Falcon · 7 tasks · 1 input · 3 outputs

Inputs

  • CaseID — The ID of the CrowdStrike Case.

Outputs

  • CrowdStrike.Detection.Behavior — CrowdStrike Detection Details.
  • CrowdStrike.Detection.Device — CrowdStrike Detection Device Details.
  • CrowdStrike.FoundDetections — Indicates whether detections were found.

Commands used

cs-falcon-get-evidence-for-case cs-falcon-search-detection

Flowchart

yes yes Start Start Get evidence for case - cs-falcon-get-evidence-for-case Get evidence for case cs-falcon-get-evidence-for-case Get full detection details - cs-falcon-search-detection Get full detection details cs-falcon-search-detection Done Done Are there related detections? Are there related detecti... Set no detections found - Set Set no detections found Set is CrowdStrike Falcon integration enabled? - IsIntegrationAvailable is CrowdStrike Falcon int... IsIntegrationAvailable