Skip to content

AI-SOC Alert Investigation

A CrowdStrike Falcon webhook starts an investigation workflow, which creates and then resolves a Jira ticket.

What you need

An AI-SOC workspace, a webhook trigger, a Falcon detection source, and a Jira connector.

Build it

The workflow runs against the source data directly. Pulling detections into a second store first was rejected as double work, so there is no re-ingestion step here.

Review the investigation graph

Coming soon

This section will cover enrichment, MITRE mapping, and how you read the graph.

Adapt it

Coming soon

This section will cover other detection sources, and how you keep a human in the loop before the ticket closes.