The "Initial CrowdStrike Case Creation" workflow template is designed to streamline case management by automating the creation of cases from CrowdStrike alerts. Upon receiving an alert, the workflow extracts and normalizes MITRE ATT&CK data, maps alert fields to a predefined case layout, and sends the data to a nested workflow to create a Torq case. This process enhances efficiency in incident response by ensuring consistent and structured case documentation.
Trigger
CrowdStrike
Use Cases
Case Management
Workflow Breakdown
Receives an alert event on a CrowdStrike Trigger.
Extract MITRE ATT&CK data from alert and normalize
Map alert fields to a predefined case layout.
Send alert data to Create a Torq Case from a Field Mapping JSON nested workflow
Vendors
Scripting, Utils, CrowdStrike, Torq Cases
Tips