Analyze_Crowdstrike_Detections__search_for_IOCs_in_VirusTotal__create_a_ticket_in_Jira_and_post_a_message_in_Slack
Configured with HTTP Request, Item Lists, Jira, Schedule Trigger, and additional nodes. Review the connections and setup before adapting this template.
Node categories in this workflow
- Trigger
- Transform
- Web / API
- Routing
- Integration
- Messaging
- Wait
Icons describe general node roles, inferred from node types. Inspect the parameters for the configured action.
Drag to pan; use + and − to zoom. Reconstructed from the exported node positions; nothing runs here. Dashed lines represent non-main connections. Full node names and notes appear below.
How it works
The exported workflow contains the following configured nodes. Their connections are shown above; inspect the JSON for the complete logic, expressions, and external actions.
| Node | Category | Type | Operation |
|---|---|---|---|
| Schedule Trigger | Trigger | Schedule Trigger | See node parameters |
| Split out detections | Transform | Item Lists | See node parameters |
| Get recent detections from Crowdstrike | Web / API | HTTP Request | See node parameters |
| Get detection details | Web / API | HTTP Request | POST |
| Split out behaviours | Transform | Item Lists | See node parameters |
| Look up SHA in Virustotal | Web / API | HTTP Request | See node parameters |
| Look up IOC in Virustotal | Web / API | HTTP Request | See node parameters |
| Split In Batches | Routing | Loop Over Items | See node parameters |
| Merge behaviour descriptions | Transform | Item Lists | summarize |
| Set behaviour descriptions | Transform | Edit Fields | See node parameters |
| Create Jira issue | Integration | Jira | See node parameters |
| Post notification on Slack | Messaging | Slack | See node parameters |
| Pause 1 second | Wait | Wait | See node parameters |
Setup
- Download the JSON and import it into an isolated n8n instance. Leave the workflow inactive.
- Connect your own credentials through n8n’s credential store. Replace
REPLACE_WITH_*values with your resource identifiers. - Inspect API destinations, Code nodes, database queries, file paths, and outbound actions.
- Run with synthetic data and harmless destinations. Enable triggers only after checking the actual outputs.
Requirements
An n8n instance with the listed node types and compatible versions. Service-connected workflows may require accounts, credentials, or paid APIs.
Credential types declared in the source
crowdStrikeOAuth2ApijiraSoftwareCloudApislackOAuth2ApivirusTotalApi
Workflow notes
Split out detections
So we can process each one individually
Workflow Overview
Workflow Overview
This n8n workflow is a robust orchestration tool designed to streamline and automate the response to cybersecurity threats detected by CrowdStrike. By running daily, the script systematically gathers new detection data, enriches it with external intelligence from VirusTotal, and then creates tickets in Jira for incident tracking and resolution. Finally, it posts notifications to Slack to alert the security team promptly.
Get details of recent CrowdStrike detections
This section initiates the workflow, scheduled to run daily at midnight, by fetching new detection events from CrowdStrike. It leverages an HTTP Request to query the CrowdStrike API, receiving a list of recent detections. These detections are then individually parsed for further analysis, ensuring that each detection is handled separately and efficiently.
Enrich each detection using VirusTotal
Enrich each detection using VirusTotal
Each detection is enhanced with additional intelligence by querying VirusTotal. The process involves looking up SHA256 hashes and other indicators of compromise (IOCs) to gather comprehensive threat information. With rate-limiting in mind, a 1-second pause is included between requests to maintain compliance with VirusTotal's API usage policies.
Pause 1 second
To avoid overloading VT
Create a Jira Ticket:
Create a Jira Ticket:
For actionable response and tracking, the workflow creates a Jira ticket for each detection. The ticket includes detailed information from CrowdStrike and enrichment data from VirusTotal, such as detection links, confidence scores, and relevant tags. This step is crucial for documenting incidents and initiating the incident response protocol.
Post Notification in Slack
Post Notification in Slack
To ensure prompt attention, a notification is sent to a designated Slack channel with the severity level of the alert and a link to the corresponding Jira ticket. This immediate notification allows for quick engagement from the security team to review and act upon the detection as needed.
Iterate Through Detection Events
Iterate Through Detection Events
The "Split In Batches" node is configured with a batch size of one, ensuring that the array of detections from CrowdStrike is divided into individual items for processing.
This approach allows for a focused analysis of each detection, ensuring no detail is overlooked.
Following this, the "Split out behaviours" node further dissects each detection to extract and separately handle the array of behaviors associated with them.
By processing these elements one by one, we effectively manage the workflow's load, maintaining optimal performance and adherence to external APIs' rate limits, crucial for the seamless operation of our security protocols.
Analyze_Crowdstrike_Detections__search_for_IOCs_in_VirusTotal__create_a_ticket_in_Jira_and_post_a_message_in_Slack
Analyze_Crowdstrike_Detections__search_for_IOCs_in_VirusTotal__create_a_ticket_in_Jira_and_post_a_message_in_Slack
Purpose and structure
This folder contains the Analyze_Crowdstrike_Detections__search_for_IOCs_in_VirusTotal__create_a_ticket_in_Jira_and_post_a_message_in_Slack workflow. Its executable nodes use httpRequest, itemLists, jira, scheduleTrigger, set, slack, splitInBatches, wait. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.
Setup
Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.
Entry points
Schedule Trigger
Verification
Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.
Attribution
https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Wait/1312_Wait_Schedule_Create_Webhook.json MIT; preserve source notices.