Skip to Workflow Atlas
Playbook AtlasWorkflow Atlas
Workflow blueprintBrowse workflows
ETL PipelineIntermediate

Crowdstrike to Incident Response Workflow

Crowdstrike to Incident Response Workflow is a 13-node automation blueprint connecting Crowdstrike, VirusTotal, Jira. Inspect its trigger, execution graph, branches, and implementation requirements.

CrowdstrikeVirusTotalJiraSlack

Interactive system map

Follow the runtime. Inspect what supports it.

Solid horizontal paths show main-channel execution. Violet dependencies sit beneath the exact step they configure or empower.

13

Nodes

13

Links

1

Run groups

Connected tools

4 integrations

  • Crowdstrike
  • VirusTotal
  • Jira
  • Slack

Canvas controls

Fit wide systems, then zoom into any run group.

Crowdstrike to Incident Response Workflow execution lanes1 run groups containing 13 workflow nodes and 13 visible links. Solid horizontal lines are main-channel runtime links. Violet dashed lines connect typed dependencies beneath the runtime step they support. Focus any node to inspect its immediate path.Schedule Trigger. trigger node, scheduleTrigger. 0 incoming and 1 outgoing connections.STARTSchedule TriggerTRIGGERSCHEDULETRIGGER0 IN / 1 OUTGet recent detections from Crowdstrike. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 02Get recent detections fro…INTEGRATIONHTTPREQUEST1 IN / 1 OUTSplit out detections. transform node, itemLists. 1 incoming and 1 outgoing connections.STEP 03Split out detectionsTRANSFORMITEMLISTS1 IN / 1 OUTGet detection details. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 04Get detection detailsINTEGRATIONHTTPREQUEST1 IN / 1 OUTSplit In Batches. integration node, splitInBatches. 2 incoming and 1 outgoing connections.STEP 05Split In BatchesINTEGRATIONSPLITINBATCHES2 IN / 1 OUTSplit out behaviours. transform node, itemLists. 1 incoming and 1 outgoing connections.STEP 06Split out behavioursTRANSFORMITEMLISTS1 IN / 1 OUTPause 1 second. integration node, wait. 1 incoming and 1 outgoing connections.STEP 07Pause 1 secondINTEGRATIONWAIT1 IN / 1 OUTLook up SHA in Virustotal. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 08Look up SHA in VirustotalINTEGRATIONHTTPREQUEST1 IN / 1 OUTLook up IOC in Virustotal. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 09Look up IOC in VirustotalINTEGRATIONHTTPREQUEST1 IN / 1 OUTSet behaviour descriptions. transform node, set. 1 incoming and 1 outgoing connections.STEP 10Set behaviour descriptionsTRANSFORMSET1 IN / 1 OUTMerge behaviour descriptions. transform node, itemLists. 1 incoming and 1 outgoing connections.STEP 11Merge behaviour descripti…TRANSFORMITEMLISTS1 IN / 1 OUTCreate Jira issue. integration node, jira. 1 incoming and 1 outgoing connections.STEP 12Create Jira issueINTEGRATIONJIRA1 IN / 1 OUTPost notification on Slack. Slack node, slack. 1 incoming and 1 outgoing connections.OUTCOMEPost notification on SlackSLACKSLACK1 IN / 1 OUT

Signal inspector

Focus, hover, or select a step to isolate its runtime and support links.

Main-channel runtimeTyped dependencytriggeraidecisiontransformintegration
Scroll horizontally to follow every connected flow.13 connected nodesEnter or click to lock · Escape to clear

Runtime breakdown

Read the execution spine before its dependencies.

Each run group separates main-channel steps from the models, tools, retrievers, and data services that support them. Start and outcome labels apply only to runtime nodes.

01

Run Group

Schedule Trigger

13 Execution Links

  1. Start

    Schedule Trigger

    Trigger

  2. Step 2

    Get recent detections from Crowdstrike

    Integration

  3. Step 3

    Split out detections

    Transform

  4. Step 4

    Get detection details

    Integration

  5. Step 5

    Split In Batches

    Integration

  6. Step 6

    Split out behaviours

    Transform

  7. Step 7

    Pause 1 second

    Integration

  8. Step 8

    Look up SHA in Virustotal

    Integration

  9. Step 9

    Look up IOC in Virustotal

    Integration

  10. Step 10

    Set behaviour descriptions

    Transform

  11. Step 11

    Merge behaviour descriptions

    Transform

  12. Step 12

    Create Jira issue

    Integration

  13. Outcome

    Post notification on Slack

    Integration

Turn the map into a plan

Adapt this blueprint to your company.

Bring the system shape into a workspace, then define the production controls, data boundaries, owners, and delivery sequence around your context.

Create a build planReturn to the atlas