Enrich CrowdStrike incidents with VirusTotal & send to TheHive
Danielle Swanser
Product Engagement Manager
Security
When a CrowdStrike endpoint detection fires, this story automatically creates a structured alert in TheHive and enriches every IP, file hash, and URL with VirusTotal — so your analysts have full context before they even open the case.
What you'll see:
- Receive a CrowdStrike endpoint detection in real time via webhook
- Map severity labels to numeric values using a severity dictionary
- Normalize and format all detection fields into a clean alert payload
- Create a new alert in TheHive, populated with the detection title, description, severity, tags, and a direct link back to CrowdStrike
- Extract all IPs, file hashes, and URLs from the alert in three parallel branches
- Look up each IP address in VirusTotal and attach the results to the TheHive alert as observables
- Filter out blank hashes, then search each MD5 and SHA256 in VirusTotal — tagging results as known or unknown
- Submit each external URL to VirusTotal, poll until the scan completes, then attach the report as an observable
Perfect for:
- SOC analysts triaging high volumes of endpoint detections who need enriched context without manual lookups
- Detection and response teams who use TheHive as their case management platform and want alerts pre-populated with threat intelligence
- Security engineers looking to connect CrowdStrike Falcon, VirusTotal, and TheHive into a single automated pipeline
Requirements:
- CrowdStrike Falcon — with a Fusion Workflow configured to forward endpoint detections to a Tines webhook
- TheHive — a running instance with API access; you'll need your tenant URL and an API key
- VirusTotal — a VirusTotal API key (free or paid tier)
- Basic familiarity with webhook configuration in CrowdStrike and TheHive's alert and observable API
