¶ Introduction
Fusion Workflows allow you to set automated tasks for a multitude of items in the CrowdStrike console, but this article will focus on how to create a workflow that will send you an email anytime there is an endpoint detection.
¶ Create a Workflow
- Click on Fusion SOAR > Workflows, once in the workflows screen click Create a Workflow.
- Set the Trigger as Event > Next
- Set the Trigger Category as Alert > Set the Subcategory as EPP Detection > Next
- Click the v and select Condition > set the If parameter as Severity > Operator as greater than or equal to > Value as Low *note this can be changed to a higher value if you are getting too many emails about low severity detections > Next > Next
- Click the v and select Action > in the search box enter & select Send Email > Next
- Set the Subject & Message fields to whatever you want > Set the Recipients to who you want to be emailed > In Data to Include there are quite a few options to choose from *See the Data to Include section for recommendations on what to include
- Click Next > then click Finish to name the workflow, add a description of the workflow, and set the Workflow Status to On > Save Workflow
¶
Data to Include Recommendations
- Action Taken: what CS did when the detection occurred
- Command Line: CMD of what was run
- IOA Description: why the detection occurred
- IOA Name: what CS calls the cause of the detection (Sensor Tampering = something tried to modify the CS Agent that wasn't CS)
- File Path: file path to where the detection occurred
- Sensor Hostname: name of the device
- Sensor Host Tags: displays any tags associated with the device
- Sensor OS Version: what OS the device is
- Severity: how serious CS thinks the detection is
- Tactics: matched to the MITRE ATT&CK framework
- Techniques: matched to the MITRE ATT&CK framework
- Sensor Host ID: CS unique ID for the device
- Sensor Host Groups: displays all Host Groups the device belongs too
- Sensor Host Type: shows if the device is a Server, Domain Controller, or Workstation
- Sensor Local IP Address: local IP of the device
¶ Example Email
Here is an example of what the email should look like:
