The "Scan Device in CrowdStrike" workflow template is designed for efficient endpoint detection and response (EDR) using CrowdStrike. It automates the process of checking a host's online status before initiating a scan. If the host is online, the workflow starts the scan and periodically checks the scan's progress every 30 seconds until completion. This ensures timely detection and response to potential threats, enhancing security operations.
Use Cases
Endpoint Detection and Response (EDR) , Function
Workflow Breakdown
Check whether the host is online and exit if not
If online, the scan is initiated; workflow then pauses to allow the scan to get underway
Re-query the host every 30 seconds until the scan is completed
Vendors
Utils, HTTP, CrowdStrike