id: CrowdStrike Falcon Malware - Incident Enrichment version: -1 fromversion: 6.10.0 name: CrowdStrike Falcon Malware - Incident Enrichment description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields. starttaskid: '0' tasks: '0': id: '0' taskid: c2bead67-50cb-4869-879b-0bdb2a5a250b type: start task: id: c2bead67-50cb-4869-879b-0bdb2a5a250b version: -1 name: '' iscommand: false brand: '' description: '' nexttasks: '#none#': - "35" separatecontext: false view: |- { "position": { "x": 602.5, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '1': id: '1' taskid: 2157cc1f-d365-42ae-8672-9db5f8c22c07 type: condition task: id: 2157cc1f-d365-42ae-8672-9db5f8c22c07 version: -1 name: Is Crowdstrike the alert source? type: condition iscommand: false brand: '' description: Is Crowdstrike the alert source? nexttasks: '#default#': - '11' yes: - '5' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: simple: incident.sourceBrand iscontext: true right: value: simple: CrowdstrikeFalcon view: |- { "position": { "x": 255, "y": 385 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '2': id: '2' taskid: af0c7571-95d7-43bc-84cf-2b2816ed6dfb type: regular task: id: af0c7571-95d7-43bc-84cf-2b2816ed6dfb version: -1 name: Enrich endpoint details description: Returns information about an endpoint. script: 'CrowdstrikeFalcon|||endpoint' type: regular iscommand: true brand: '' nexttasks: '#none#': - '12' scriptarguments: id: simple: ${incident.agentsid} continueonerror: true separatecontext: false view: |- { "position": { "x": 490, "y": 1930 } } note: false timertriggers: [] ignoreworker: false fieldMapping: - incidentfield: Device Status output: simple: ${Endpoint.IsIsolated} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '5': id: '5' taskid: db31b678-8cca-464e-ab4e-ab50c4c55bef type: condition task: id: db31b678-8cca-464e-ab4e-ab50c4c55bef version: -1 name: Is this a case or a detection? type: condition iscommand: false brand: '' description: Is this a case or a detection? nexttasks: detection: - '8' ngsiem_case: - "6" separatecontext: false conditions: - label: ngsiem_case condition: - - operator: isEqualString left: value: simple: incident.externalcategoryname iscontext: true right: value: simple: ngsiem_case ignorecase: true - label: detection condition: - - operator: isEqualString left: value: simple: incident.externalcategoryname iscontext: true right: value: simple: detection ignorecase: true view: |- { "position": { "x": 582.5, "y": 560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '6': id: '6' taskid: 9d29f30a-db90-4385-be9c-4fa314c2afda type: title task: id: 9d29f30a-db90-4385-be9c-4fa314c2afda version: -1 name: ngsiem_case type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - "36" separatecontext: false view: |- { "position": { "x": 1052.5, "y": 902.5 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '8': id: '8' taskid: dfd0c2b3-0170-4ef0-8273-ff75fe4127e8 type: title task: id: dfd0c2b3-0170-4ef0-8273-ff75fe4127e8 version: -1 name: Detection type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - "32" separatecontext: false view: |- { "position": { "x": 357.5, "y": 735 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '9': id: '9' taskid: 8332b249-c325-4196-8073-1c334a9edec4 type: regular task: id: 8332b249-c325-4196-8073-1c334a9edec4 version: -1 name: Map behaviors data to the context description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: '' nexttasks: '#none#': - '15' scriptarguments: append: simple: 'true' key: simple: CrowdStrike.Detection value: complex: root: incident accessor: additionaldata transformers: - operator: join args: separator: value: simple: ',' - operator: Stringify - operator: concat args: prefix: value: simple: '{"Behavior":[' suffix: value: simple: ']}' separatecontext: false view: |- { "position": { "x": 500, "y": 1245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '11': id: '11' taskid: 74e5f7c5-c113-46dc-8e14-34195b5a2435 type: title task: id: 74e5f7c5-c113-46dc-8e14-34195b5a2435 version: -1 name: Done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 490, "y": 2630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '12': id: '12' taskid: bc402fbc-7adb-45aa-86c7-11ed48218beb type: regular task: id: bc402fbc-7adb-45aa-86c7-11ed48218beb version: -1 name: Set endpoint information to layout description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '13' scriptarguments: deviceid: simple: ${Endpoint.[0].ID} devicelocalip: simple: ${Endpoint.[0].IPAddress} devicemacaddress: simple: ${Endpoint.[0].MACAddress} devicename: simple: ${Endpoint.[0].Hostname} deviceosname: simple: ${Endpoint.[0].OS} deviceosversion: simple: ${Endpoint.[0].OSVersion} devicestatus: simple: ${Endpoint.[0].Status} isolated: simple: ${Endpoint.[0].IsIsolated} continueonerror: true separatecontext: false view: |- { "position": { "x": 490, "y": 2105 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '13': id: '13' taskid: 76cc6bfa-107f-4440-85c0-066f67bede92 type: condition task: id: 76cc6bfa-107f-4440-85c0-066f67bede92 version: -1 name: Is there only one endpoint? description: Checks whether given entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, will return 'yes' if one of the entries returns an error. scriptName: isError type: condition iscommand: false brand: '' nexttasks: '#default#': - '11' yes: - '27' scriptarguments: entryId: simple: ${lastCompletedTaskEntries} separatecontext: false view: |- { "position": { "x": 490, "y": 2280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '15': id: '15' taskid: 79031241-cac7-4365-82fd-fb32ff32f28e type: regular task: id: 79031241-cac7-4365-82fd-fb32ff32f28e version: -1 name: Set process details to layout description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '23' scriptarguments: filesha256: simple: ${CrowdStrike.Detection.Behavior.sha256} md5: simple: ${CrowdStrike.Detection.Behavior.md5} parentprocessfilepath: simple: ${CrowdStrike.Detection.Behavior.filepath} processname: simple: ${CrowdStrike.Detection.Behavior.filename} sha256: simple: ${CrowdStrike.Detection.Behavior.sha256} separatecontext: false view: |- { "position": { "x": 357.5, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '17': id: '17' taskid: 04c0cbb3-0a7a-43e3-8e2d-935ea26d41d1 type: title task: id: 04c0cbb3-0a7a-43e3-8e2d-935ea26d41d1 version: -1 name: Alert details settings type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '22' separatecontext: false view: |- { "position": { "x": 50, "y": 2287.5 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '18': id: '18' taskid: 35719fbb-71d9-4c29-b5f4-94b888f8d205 type: regular task: id: 35719fbb-71d9-4c29-b5f4-94b888f8d205 version: -1 name: Set process details to layout description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '23' scriptarguments: filesha256: simple: ${CrowdStrike.Detection.Behavior.sha256} md5: simple: ${CrowdStrike.Detection.Behavior.md5} parentprocessfilepath: simple: ${CrowdStrike.Detection.Behavior.filepath} processname: simple: ${CrowdStrike.Detection.Behavior.filename} agentsid: simple: ${CrowdStrike.Detection.Device.device_id} separatecontext: false view: |- { "position": { "x": 1165, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" continueonerror: true '22': id: '22' taskid: 99114fdc-1204-48ec-a77f-15c224f5f3e5 type: regular task: id: 99114fdc-1204-48ec-a77f-15c224f5f3e5 version: -1 name: Set alert details to grid description: Creates a Grid table from items or key-value pairs. scriptName: SetGridField type: regular iscommand: false brand: '' nexttasks: '#none#': - '11' scriptarguments: columns: simple: Alert Name,Hostname,File Name,Process ID,SHA256,Command Line context_path: simple: CrowdStrike.Detection.Behavior grid_id: simple: alertsandrelatedinfo keys: simple: display_name,device_id,filename,,sha256,cmdline overwrite: simple: 'true' separatecontext: false view: |- { "position": { "x": 50, "y": 2455 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '23': id: '23' taskid: e6b801e9-cdb2-4b93-88e8-075fedce7acf type: regular task: id: e6b801e9-cdb2-4b93-88e8-075fedce7acf version: -1 name: Extract indicators description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '17' - '26' - "29" scriptarguments: text: simple: ${CrowdStrike.Detection} reputationcalc: 2 separatecontext: false view: |- { "position": { "x": 480, "y": 1595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '24': id: '24' taskid: 917ba69d-a87b-44d5-aef4-7df50af3cf28 type: condition task: id: 917ba69d-a87b-44d5-aef4-7df50af3cf28 version: -1 name: Are there related detections? description: Are there related detections? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' yes: - '18' separatecontext: false conditions: - label: yes condition: - - operator: isExists left: value: simple: CrowdStrike.Detection iscontext: true view: |- { "position": { "x": 1052.5, "y": 1245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '25': id: '25' taskid: ed8a7a7b-f719-457b-8ae2-c750873e39d9 type: title task: id: ed8a7a7b-f719-457b-8ae2-c750873e39d9 version: -1 name: No detections found type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '26' - "29" separatecontext: false view: |- { "position": { "x": 1052.5, "y": 1602.5 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '26': id: '26' taskid: d54a9ebd-1264-48b7-8e56-03ab31e13955 type: title task: id: d54a9ebd-1264-48b7-8e56-03ab31e13955 version: -1 name: Set endpoint details type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '2' separatecontext: false view: |- { "position": { "x": 490, "y": 1770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '27': id: '27' taskid: 10024a5a-52be-477a-8497-2e70c01bc015 type: regular task: id: 10024a5a-52be-477a-8497-2e70c01bc015 version: -1 name: Set endpoint information to layout description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '11' scriptarguments: deviceid: simple: ${Endpoint.ID} devicelocalip: simple: ${Endpoint.IPAddress} devicemacaddress: simple: ${Endpoint.MACAddress} devicename: simple: ${Endpoint.Hostname} deviceosname: simple: ${Endpoint.OS} deviceosversion: simple: ${Endpoint.OSVersion} devicestatus: simple: ${Endpoint.Status} isolated: simple: ${Endpoint.IsIsolated} separatecontext: false continueonerror: true view: |- { "position": { "x": 715, "y": 2455 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "29": id: "29" taskid: c5a42836-8fb5-4dea-8ef8-35bd256bbbb9 type: title task: id: c5a42836-8fb5-4dea-8ef8-35bd256bbbb9 version: -1 name: Account Enrichment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "31" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1042.5, "y": 1770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: e2d538bd-b311-46e4-8b89-a890955ae666 type: regular task: id: e2d538bd-b311-46e4-8b89-a890955ae666 version: -1 name: Set Account information to layout description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "11" scriptarguments: accountmemberof: complex: root: Account accessor: Groups transformers: - operator: uniq - operator: replace args: limit: {} replaceWith: value: simple: / toReplace: value: simple: ',' - operator: concat args: prefix: value: simple: '"' suffix: value: simple: '"' - operator: join args: separator: value: simple: ',' accountname: complex: root: Account accessor: DisplayName transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.DisplayName iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.DisplayName iscontext: true then: value: simple: IAM.UserProfile.profile=val.firstName + ' ' + val.lastName iscontext: true accountstatus: complex: root: Account accessor: Status transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Status iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Status iscontext: true then: value: simple: IAM.UserProfile.status iscontext: true employeeemail: complex: root: Account accessor: Email transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Email iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Email iscontext: true then: value: simple: IAM.UserProfile.profile.email iscontext: true - operator: uniq - operator: FirstArrayElement employeetype: complex: root: Account accessor: Type transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Type iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Type iscontext: true then: value: simple: IAM.UserProfile.profile.userType iscontext: true managername: complex: root: Account accessor: Manager transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Manager iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Manager iscontext: true then: value: simple: IAM.UserProfile.profile.manager iscontext: true samaccountname: complex: root: Account accessor: Username transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Username iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Username iscontext: true then: value: simple: IAM.UserProfile.profile.login manageremailaddress: complex: root: UserManagerEmail filters: - - operator: isNotEmpty left: value: simple: UserManagerEmail iscontext: true transformers: - operator: uniq - operator: FirstArrayElement separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1042.5, "y": 2105 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 0d05e7e6-e966-4e8e-896f-ab88c505e713 type: playbook task: id: 0d05e7e6-e966-4e8e-896f-ab88c505e713 version: -1 name: Account Enrichment - Generic v2.1 playbookName: Account Enrichment - Generic v2.1 type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "30" scriptarguments: Username: complex: root: incident.users filters: - - operator: isNotEmpty left: value: simple: incident.users iscontext: true transformers: - operator: uniq - operator: FirstArrayElement separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1042.5, "y": 1930 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: d5521d11-dfe4-4c6a-881f-e2ac565cf4a8 type: condition task: id: d5521d11-dfe4-4c6a-881f-e2ac565cf4a8 description: "Behaviors exist in detection?" version: -1 name: Behaviors exist in detection? type: condition iscommand: false brand: "" nexttasks: '#default#': - "34" "yes": - "9" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: incident.additionaldata iscontext: true continueonerrortype: "" view: |- { "position": { "x": 357.5, "y": 895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: cbf69576-b317-42f4-86e6-106943e380a6 type: regular task: id: cbf69576-b317-42f4-86e6-106943e380a6 version: -1 name: Map selected fields to the context description: Set multiple keys/values to the context. scriptName: SetMultipleValues type: regular iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: keys: simple: sha256,md5,filepath,filename parent: simple: CrowdStrike.Detection.Behavior values: simple: ${incident.sha256},${incident.md5},${incident.filepaths.[0]},${incident.filename} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 938a2777-f8ba-432c-8c75-e4582fb3919b type: regular task: id: 938a2777-f8ba-432c-8c75-e4582fb3919b version: -1 name: Load behavior pattern to context description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "33" scriptarguments: extend-context: simple: CrowdStrike.Detection.Behavior.pattern_disposition_details=. ignore-outputs: simple: "true" key: simple: CrowdStrike.Detection.Behavior.pattern_disposition_details value: simple: ${incident.crowdstrikefalconbehaviourpatterndispositiondetails.[0]} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea type: condition task: id: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea version: -1 name: is CrowdStrike Falcon integration enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "11" "yes": - "1" scriptarguments: brandname: simple: CrowdstrikeFalcon separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 602.5, "y": 210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb type: playbook task: id: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb version: -1 name: CrowdStrike Falcon - Get Detections by Case playbookName: CrowdStrike Falcon - Get Detections by Case type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "24" scriptarguments: CaseID: simple: ${inputs.DetectionOrCaseID} separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1052.5, "y": 1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 2640, "width": 1495, "x": 50, "y": 50 } } } inputs: - key: DetectionOrCaseID value: simple: ${incident.externalsystemid} required: false description: The ID of the CrowdStrike detection or Case. playbookInputQuery: outputs: - contextPath: CrowdStrike type: unknown description: CrowdStrike Detection or Incident details. - contextPath: Endpoint type: unknown description: Endpoint details. - contextPath: CrowdStrike.FoundDetections description: 'Indicates whether detections were found.' type: string tests: - No tests (auto formatted) contentitemexportablefields: contentitemfields: {} marketplaces: - xsoar inputSections: - inputs: - DetectionOrCaseID name: General (Inputs group) description: Generic group for inputs outputSections: - outputs: - CrowdStrike - Endpoint - CrowdStrike.FoundDetections name: General (Outputs group) description: Generic group for outputs