Details

This atomic belongs to the CrowdStrike atomic group.

This atomic allows to search for CrowdStrike Alert IDs.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:

  • Build the authorization headers
  • Search for matching alerts
  • Check if the API request succeeded:
    • If it did, extract the results and set the output variables
    • If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

About
Authorship
Cisco Managed