AI-SOC Alert Investigation¶

A CrowdStrike Falcon webhook starts an investigation workflow, which creates and then resolves a Jira ticket.

What you need¶

An AI-SOC workspace, a webhook trigger, a Falcon detection source, and a Jira connector.

Build it¶

The workflow runs against the source data directly. Pulling detections into a second store first was rejected as double work, so there is no re-ingestion step here.

Review the investigation graph¶

TODO: enrichment, MITRE mapping, and reading the graph.

Adapt it¶

TODO: other detection sources, and keeping a human in the loop before the ticket is resolved.