CrowdStrike - Delete Custom IOCs for Observables

This incident response workflow allows you to delete custom IOCs for observables in CrowdStrike from a playbook. Supported observables: domain, IP, IPv6, MD5, SHA256.

Target: CrowdStrike

Steps:

• For each selected observable:
  • Check if the observable type is supported (if not, end the workflow)
  • Search for matching indicators in CrowdStrike
  • If an indicator is found:
    • Attempt to extract the indicator ID (if that fails, end the workflow)
    • Delete the indicator
    • Check if the indicator was deleted and update the workflow result