Contain a host in CrowdStrike
Automatically contain a host in CrowdStrike from a Slack request with Stepwork. Find the host in Falcon, network-contain it, and confirm the status.
- Use case
- Security response & remediationInfoSec & Compliance
- Best for
- Security Analyst, SOC Analyst
- Applications used
CrowdStrike
Slack
- Business outcome
- Risk reduction
The problem
The analyst knows which host. The console is busy.
During an incident, the call to contain a host comes fast. The click comes later, when someone with Falcon console access is free to sign in, find the host, and contain it.
Every minute of that wait, a compromised machine can still reach the rest of the network. When the incident review asks when containment started, the time lives in a chat thread.
The outcome
Containment starts when the call is made
Stepwork network-contains the host named in the request from the Falcon console and confirms the status. The run records who asked, which host was contained, and when.
- The request names the host and the incident it belongs to.
- A hostname that matches nobody, or more than one host, stops the run.
- The Slack reply confirms the host reads Contained.
The process
From Slack request to a contained host
A security analyst posts the host in Slack. Stepwork contains it in the CrowdStrike Falcon console, in the same order every time.
- Step 1
Request it in Slack
A security analyst posts the hostname and the incident ticket in the security channel. That message starts the flow, and Stepwork records who asked and when.
- Step 2
Find the host
Stepwork signs in to the Falcon console and opens the host in host management. If the hostname matches nobody, or more than one host, the run stops instead of guessing.
- Step 3
Network-contain the host
Stepwork contains the host, the same action an analyst takes from the host’s page. The host keeps its link to CrowdStrike and loses the rest of the network.
- Step 4
Confirm and reply in Slack
Stepwork checks that the status reads Contained, then posts the result back in Slack with a timestamp.
Why Stepwork
The containment click no longer waits on a person
A deterministic agent runs the containment path you recorded in Falcon. Credentials stay in 1Password, so the analyst who makes the call does not need to hold console access to act on it.
Similar use cases
Similar use cases
Reset MFA factors for user in OktaFinds the user in Okta admin, resets all enrolled MFA factors, and triggers re-enrollment at next sign-in.
Disable external forwarding rule in Microsoft 365Removes a specified mailbox's external auto-forwarding rule and confirms deletion.
FAQ