CrowdStrike - Create Custom IOC
Details
This workflow appears in the pivot menu and allows you to create an IOC in CrowdStrike for an observable.
Description
This workflow appears in the pivot menu and allows you to create an IOC in CrowdStrike for an observable. Supported observables: domain, IP address, IPv6 address, MD5, SHA-256
Target: CrowdStrike
Steps:
- Check which type of observable was provided and update the local variables accordingly
- Request to create a custom IOC
- Check if the IOC was created:
- If not, output an error
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- CrowdStrike
About
Author
Cisco
Version
v1.0
Intent
Pivot Menu
Integration
Average rating
No ratings yet
Authorship
Cisco Managed
Contact and support information
External links
Related workflows
Cisco Managed
This workflow appears in the pivot menu and allows a user to contain a host in CrowdStrike.
Cisco Managed
This incident response workflow allows you to contain hosts involved in an incident using CrowdStrike from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and allows you to create an IOC in CrowdStrike for an observable.
Cisco Managed
This incident response workflow allows you to create custom IOCs for observables in CrowdStrike from a playbook.
Cisco Managed
This incident response workflow allows you to delete custom IOCs for observables in CrowdStrike from a playbook.
Cisco Managed
This incident response workflow allows to document a summary of vulnerabilities for hosts in an incident using CrowdStrike from a playbook or using an automation rule.
Cisco Managed
This incident response workflow allows you to lift containment for hosts in CrowdStrike from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and allows a user to lift containment for a host in CrowdStrike.