Verify CrowdStrike coverage on newly provisioned devices
Build a workflow triggered by a ServiceNow new-device notification. Look the device up in CrowdStrike to confirm the agent is installed and reporting. If absent, initiate a Qualys vulnerability assessment and post a Slack alert to the endpoint team with the device details. Handle devices not yet checked in, ambiguous hostname matches, and API errors. Output the coverage status and any scan initiated.
What this prompt builds
When a device is provisioned, confirm CrowdStrike is installed and run a Qualys scan if it isn't.
The problem
Newly provisioned devices sometimes miss the EDR agent, leaving blind spots that no one notices until an incident. Coverage gaps are exactly where attackers want to land.
Solution and impact
This workflow reacts to ServiceNow provisioning notifications, checks CrowdStrike for the agent, and triggers a Qualys vulnerability assessment when it's missing, alerting via Slack. Every new device is confirmed protected or flagged immediately.