The "Manage Containment on a Device in CrowdStrike" workflow template is designed for businesses utilizing Endpoint Detection and Response (EDR) solutions. It enables security teams to efficiently manage device containment within CrowdStrike, offering options to either "Contain" or "Lift Containment" on a specified device. This workflow ensures that devices are securely managed, minimizing potential threats and maintaining operational integrity.
Use Cases
Endpoint Detection and Response (EDR)
Workflow Breakdown
Check whether the host is online
If online, the host will either be contained or have containment lifted depending on user input
Check if the action was successful
Vendors
Utils, CrowdStrike