Enrich CrowdStrike incidents with VirusTotal & send to TheHive

When a CrowdStrike endpoint detection fires, this story automatically creates a structured alert in TheHive and enriches every IP, file hash, and URL with VirusTotal — so your analysts have full context before they even open the case.

---

What you'll see:

• Receive a CrowdStrike endpoint detection in real time via webhook
• Map severity labels to numeric values using a severity dictionary
• Normalize and format all detection fields into a clean alert payload
• Create a new alert in TheHive, populated with the detection title, description, severity, tags, and a direct link back to CrowdStrike
• Extract all IPs, file hashes, and URLs from the alert in three parallel branches
• Look up each IP address in VirusTotal and attach the results to the TheHive alert as observables
• Filter out blank hashes, then search each MD5 and SHA256 in VirusTotal — tagging results as known or unknown
• Submit each external URL to VirusTotal, poll until the scan completes, then attach the report as an observable

---

Perfect for:

• SOC analysts triaging high volumes of endpoint detections who need enriched context without manual lookups
• Detection and response teams who use TheHive as their case management platform and want alerts pre-populated with threat intelligence
• Security engineers looking to connect CrowdStrike Falcon, VirusTotal, and TheHive into a single automated pipeline

---

Requirements:

• CrowdStrike Falcon — with a Fusion Workflow configured to forward endpoint detections to a Tines webhook
• TheHive — a running instance with API access; you'll need your tenant URL and an API key
• VirusTotal — a VirusTotal API key (free or paid tier)
• Basic familiarity with webhook configuration in CrowdStrike and TheHive's alert and observable API