CrowdStrike Falcon - Get Detections by Incident Deprecated

Deprecated. Use the `CrowdStrike Falcon - Get Detections by Case` playbook instead.

CrowdStrike Falcon · 6 tasks · 1 input · 2 outputs

Inputs

  • IncidentID — The ID of the CrowdStrike incident.

Outputs

  • CrowdStrike.Detection.Behavior — CrowdStrike Detection Details
  • CrowdStrike.FoundDetections — Indicates whether detections were found.

Commands used

cs-falcon-get-detections-for-incident cs-falcon-search-detection

Flowchart

true Start Start Get detections for incident - cs-falcon-get-detections-for-incident Get detections for incident cs-falcon-get-detections-for-... Get full detection details - cs-falcon-search-detection Get full detection details cs-falcon-search-detection Done Done Are there related detections? Are there related detecti... Set no detections found - Set Set no detections found Set