This n8n workflow automates the handling of security detections from CrowdStrike, streamlining incident response and notification processes. The workflow is triggered daily at midnight by the Schedule Trigger node. It begins by fetching recent security detections from CrowdStrike using an HTTP Request node. The response is then split into individual detections for further processing. Each detection is enriched by querying the CrowdStrike API for detailed information using another HTTP Request node. The workflow then processes these detections sequentially using the Split In Batches node. Next, it looks up behavioral information associated with each detection in VirusTotal using two HTTP Request nodes. One node queries VirusTotal based on SHA256 values, and the other based on IOC (Indicator of Compromise) values. The workflow includes a 1-second pause using the Wait node to prevent rate limiting when making requests to the VirusTotal API. Subsequently, the workflow sets fields with relevant details from both CrowdStrike and VirusTotal, including detection links, confidence scores, filenames, usernames, and more.
Tags
Jira SoftwareSlackRelated workflows
See all Jira→Notify User in Slack of Quarantined Email and Create Jira Ticket if Opened
This n8n workflow serves as an incident response and notification system for handling potentially malicious emails flagged by Sublime Security. It begins with a Webhook trigger that Sublime Security uses to initiate the workflow by POSTing an alert. The workflow then extracts message details from Sublime Security using an HTTP Request node, based on the provided messageId, and subsequently splits into two parallel paths. In the first path, the workflow looks up a Slack user by email, aiming to find the recipient of the email that triggered the alert. If a user is found in Slack, a notification is sent to them, explaining that they have received a potentially malicious email that has been quarantined and is under investigation. This notification includes details such as the email's subject and sender. The second path checks whether the flagged email has been opened by inspecting the read_at value from Sublime Security. If the email was opened, the workflow prepares a table summarizing the flagged rules and creates a corresponding issue in Jira Software. The Jira issue contains information about the email, including its subject, sender, and recipient, along with the flagged rules. Is
Manage custom incident response in PagerDuty and Jira
This workflow automatically follows the steps in a custom incident response playbook and manages incidents in PagerDuty, Jira tickets, and notifies the on-call team in Mattermost. This workflow consists of three sub-workflows, each automating specific steps in the playbook. Read more about this use case and learn how to set up the workflows step-by-step in the blog tutorial How to automate every step of an incident response workflow. Prerequisites A PagerDuty account and credentials A Mattermost account and credentials A Jira account and credentials Nodes Webhook nodes trigger the workflows when an incident is created in PagerDuty, and when the incidedent is acknowledged and resolved. Mattermost nodes create an auxiliary channel for the on-call team to discuss the incident with buttons to acknowledge the incident and mark it as resolved. PagerDuty nodes update the status of the incident. Jira nodes create an issue about the incident and update its status when it's resolved.
Incident Response Workflow - Part 3
This workflow is the third of three. You can find the other workflkows here: Incident Response Workflow - Part 1 Incident Response Workflow - Part 2 Incident Response Workflow - Part 3 We have the following nodes in the workflow: Webhook node: This trigger node listens to the event when the Resolve button is clicked. PagerDuty node: This node changes the status of the incident report from Acknowledged to Resolved in PagerDuty. Jira Software node: This node moves the incident issue to Done. Mattermost node: This node publishes a message in the auxiliary channel mentioning that the incident has been marked as resolved in PagerDuty and Jira. Mattermost node: This node publishes a message in the specified Incidents channel that the incident has been resolved by the on-call team.