CrowdStrike
This is a detailed guide on implementing a Crowdstrike Fusion workflow that will auto-close Prelude originating detections.
- Download the two following .yaml files
- In the Crowdstrike Console, navigate to "Fusion SOAR" and select "Workflows"
- Select "Create Workflow", then choose "Import Workflow"
- Select "Upload Workflow file" and import the two files downloaded in step 1
- Change the last sleep in the second workflow(Prelude Alert Suppression_2) to an alerting action such a "Send Email" or "Send Slack" (see screenshot below). This will ensure that you get notified for any non Prelude alerts.
Updated 7 months ago