Verify CrowdStrike coverage on newly provisioned devices
Build a workflow triggered by a ServiceNow notification for a newly provisioned device, carrying hostname/asset details. Query CrowdStrike to confirm the agent is installed and reporting. If present, log compliance; if absent, initiate a Qualys vulnerability scan of the device and post a Slack alert to the endpoint team with remediation steps. Handle devices not yet checked in with a retry/grace window, and avoid duplicate alerts. Output the coverage status and any scan initiated.
What this prompt builds
When ServiceNow provisions a device, confirm CrowdStrike is installed and run a Qualys scan if it isn't.
The problem
Devices slip into production without the EDR agent installed, creating blind spots that attackers exploit. Nobody systematically checks coverage at provisioning time.
Solution and impact
This workflow listens for new-device events from ServiceNow, checks CrowdStrike for the agent, and triggers a Qualys vulnerability assessment plus a Slack alert when the agent is missing. EDR coverage gaps are caught at birth instead of months later.