CrowdStrike - Lift Containment for Hosts

This incident response workflow allows you to lift containment for hosts in CrowdStrike from a playbook or using an automation rule. When using this workflow in a playbook, the user selects which hosts to lift containment for. When using this workflow with an incident automation rule, all assets involved in the incident are removed from containment. Supported observables: hostname, MAC address, CrowdStrike ID

Target: CrowdStrike

Steps:

• Detect the start type and extract the observables
• Check if any supported observables were found (if not, end the workflow)
• For each observable:
  • Check the observable's type:
    • If a CrowdStrike ID, set the local ID variable
    • If a hostname or a MAC address, set the necessary local variable and search for the host
  • Fetch the host from CrowdStrike by ID and extract its hostname
  • Lift containment for the host
  • Check if the containment was lifted for the host and update the workflow result