Deprecated. Use the CrowdStrike Falcon integration instead.

Enrich Endpoint with CrowdStrike

Hunt for endpoint activity involving hash and domain IOCs using Crowdstrike Falcon Host.\nAlso use AnalystEmail label to determine where to send an email alert if something is found.

Hunt for endpoint activity involving hash and domain IOCs, using Crowdstrike Falcon Host

This will parse a CrowdStrike alert URL and pull out the Agent ID. Useful for passing to the cs-device-details command to return device details.

It also returns the detection ID for the specific alert. Used for modifying the state of the alert for CrowdStrike.