Skip to main content

CrowdStrike Falcon Malware - Incident Enrichment

This Playbook is part of the CrowdStrike Falcon Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

CrowdStrike Falcon - Get Detections by Incident

Integrations#

CrowdStrikeFalcon

Scripts#

  • SetGridField
  • SetAndHandleEmpty
  • isError

Commands#

  • extractIndicators
  • setIncident
  • endpoint

Playbook Inputs#


NameDescriptionDefault ValueRequired
DetectionOrIncidentIDThe ID of the CrowdStrike detection or incident.${incident.externalsystemid}Optional

Playbook Outputs#


PathDescriptionType
CrowdStrikeCrowdStrike Detection or Incident details.unknown
EndpointEndpoint details.unknown
CrowdStrike.FoundDetectionsIndicates whether detections were found.string

Playbook Image#


CrowdStrike Falcon Malware - Incident Enrichment