This workflow template automates the process of monitoring Crowdstrike alerts for cybersecurity threats by regularly fetching data from the Crowdstrike API. Upon retrieval, the workflow maps the alert fields to a predefined case layout and deduplicates to prevent case duplication. Each new and unique alert results in the creation of a case within Torq. This enables security teams to streamline incident response, ensuring quick detection and organization of potential security breaches.
Use Cases
Case Management
Workflow Breakdown
Establish a checkpoint to mark accurate beginning and end times.
Pull alerts from Crowdstrike API on schedule.
Map alert fields to a predefined case layout.
Create a case for each new alert.
Vendors
Utils, CrowdStrike, Torq, Torq Cases
Tips