CrowdStrike Falcon Malware - Incident Enrichment
This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.
CrowdStrike Falcon · 27 tasks · 1 input · 3 outputs
Inputs
DetectionOrCaseID— The ID of the CrowdStrike detection or Case.
Outputs
CrowdStrike— CrowdStrike Detection or Incident details.Endpoint— Endpoint details.CrowdStrike.FoundDetections— Indicates whether detections were found.
Commands used
endpoint
extractIndicators
setIncident