The "Scan Device in CrowdStrike with Socrates" workflow template streamlines endpoint security by automating device scans within CrowdStrike. Designed for efficient incident response, it queries users for comments, extracts device IDs from cases, and initiates scans using the "Scan Device in CrowdStrike" workflow. Successful scans result in case notes, enhancing security operations and documentation. Ideal for Endpoint Detection and Response (EDR) tasks.
Use Cases
Endpoint Detection and Response (EDR) , Function
Workflow Breakdown
Queries the user for a comment for the action
The device ID is extracted from the corresponding case or it can be provided in the user query (for use with Socrates Off-Case)
The 'Scan Device in CrowdStrike' workflow is called
If the workflow is successful, a note is added to the associated case
Vendors
Utils, HTTP, CrowdStrike, Torq Cases