← Go back to library

Enrich CrowdStrike detections with Active Directory and correlate in Jira tickets

CrowdStrike detections are listed and for each detection, it determines the device owner in Active Directory. The detection is documented in Jira, either in a new ticket or an existing ticket if it is related to another existing detection. The unique identifier for determining if the Jira ticket is related is based on the "hostname, filename/path/hash" for each behaviour.

How it works

Import this story to your tenant, from where you can adapt it to meet your unique needs.

Import
Was this story helpful?