Lift host containment in CrowdStrike
Automatically lift host containment in CrowdStrike from a Slack request with Stepwork. Release the remediated host and verify it is back online.
- Use case
- Security response & remediationInfoSec & Compliance
- Best for
- Security Analyst
- Applications used
CrowdStrike
Slack
- Business outcome
- Time savings
The problem
The host is clean. It is still cut off.
Once remediation is done, the host needs one change in the Falcon console. That change waits for whoever owns the console, and the person who uses the machine waits with it.
A clean laptop or server stays off the network for hours. Releases happen in whatever order people remember them, and nobody notes when each host came back.
The outcome
Clean hosts go back to work without waiting
Stepwork lifts network containment on the host named in the request and verifies its connectivity status. The run records who asked, which host was released, and when.
- The request names the host and its remediation ticket.
- A host that is not contained stops the run.
- The Slack reply confirms the host is back online.
The process
From Slack request to a released host
A security analyst posts the remediated host in Slack. Stepwork lifts containment in the CrowdStrike Falcon console, in the same order every time.
- Step 1
Request it in Slack
A security analyst posts the hostname and the remediation ticket in the security channel. That message starts the flow, and Stepwork records who asked and when.
- Step 2
Find the contained host
Stepwork signs in to the Falcon console, opens the host, and checks that its status reads Contained. If it does not, or the hostname matches more than one host, the run stops.
- Step 3
Lift containment
Stepwork lifts containment, the same action an analyst takes from the host’s page. The host can reach the network again.
- Step 4
Confirm and reply in Slack
Stepwork checks that containment is lifted and the host is online, then posts the result back in Slack with a timestamp.
Why Stepwork
Release follows the same path as containment
Stepwork runs the release path you recorded in Falcon. A clean host returns to service when your team signs off, not when the console owner is next free.
Similar use cases
Similar use cases
Force a password change in Microsoft Entra IDResets a user's password in Entra and requires a change at next sign-in.
Disable external forwarding rule in Microsoft 365Removes a specified mailbox's external auto-forwarding rule and confirms deletion.
FAQ