This workflow, scheduled to regularly query Splunk, identifies new CrowdStrike detections and creates a detailed Torq case for each incident. It enriches each detection with comprehensive information on the affected device and user, obtained directly from CrowdStrike, ensuring that every Torq case is packed with valuable context for thorough incident investigation and response. This integration optimizes case management and enhances an organization's Endpoint Detection and Response (EDR) capabilities through streamlined detection, enrichment, and response automation.
Use Cases
Case Management , Endpoint Detection and Response (EDR)
Workflow Breakdown
Query Splunk on a schedule to find new Crowdstrike detections
Loop over each detection and enrich details from Crowdstrike on the device and user
Open a Torq case with the details from each Crowdstrike detection and create observables and custom fields as part of the Torq case
Vendors
Utils, CrowdStrike, Splunk, Torq, Torq Cases
Workflow Output
New Torq cases for Crowdstrike detections from events sent to Splunk