The "Query CrowdStrike Next-Gen SIEM" workflow template is designed for security professionals engaged in threat hunting and incident response. It enables users to execute ad-hoc CQL searches against CrowdStrike's Next-Gen SIEM, facilitating the retrieval of specific security events. By automating the creation, polling, and result-fetching of query jobs, this workflow streamlines the process of accessing critical security insights, enhancing the efficiency of security operations.
Use Cases
Function , Threat Hunting
Workflow Breakdown
Create an async query job.
Poll until CrowdStrike marks it done.
Fetch and return the final results.
Vendors
Utils