The "QuickAction - Scan Device in CrowdStrike" workflow template streamlines the process of initiating a device scan within CrowdStrike, enhancing endpoint detection and response capabilities. By leveraging a QuickAction button, users can efficiently trigger a scan on a specified device, ensuring swift action in incident response scenarios. This workflow automates the extraction of device IDs and logs scan results directly into the associated case, optimizing security operations.
Use Cases
Endpoint Detection and Response (EDR) , Function
Workflow Breakdown
Query the user for a comment for the action
The device ID is extracted from the corresponding case
If the action is successful, a note is added to the associated case
Vendors
Utils, HTTP, CrowdStrike, Torq Cases