CrowdStrike - Lift Host Containment
Details
This workflow appears in the pivot menu and allows a user to lift containment for a host in CrowdStrike.
Description
This workflow appears in the pivot menu and allows a user to lift containment for a host in CrowdStrike. Supported observables: hostname, IP address, MAC address, CrowdStrike ID
Target: CrowdStrike
Steps:
- Determine which observable type was provided:
- If a CrowdStrike ID, set the local ID variable
- If a hostname, IP, or MAC, search for the host and set the local ID variable (if a host isn't found, end the workflow)
- Request the lift_containment host action be executed
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- CrowdStrike
About
Author
Cisco
Version
v1.2
Intent
Pivot Menu
Integration
Average rating
No ratings yet
Authorship
Cisco Managed
Contact and support information
External links
Related workflows
Cisco Managed
This workflow appears in the pivot menu and allows a user to contain a host in CrowdStrike.
Cisco Managed
This incident response workflow allows you to contain hosts involved in an incident using CrowdStrike from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and allows you to create an IOC in CrowdStrike for an observable.
Cisco Managed
This incident response workflow allows you to create custom IOCs for observables in CrowdStrike from a playbook.
Cisco Managed
This incident response workflow allows you to delete custom IOCs for observables in CrowdStrike from a playbook.
Cisco Managed
This incident response workflow allows to document a summary of vulnerabilities for hosts in an incident using CrowdStrike from a playbook or using an automation rule.
Cisco Managed
This incident response workflow allows you to lift containment for hosts in CrowdStrike from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and allows a user to lift containment for a host in CrowdStrike.