Analyze CrowdStrike detections - Search for IOCs in VirusTotal - Create a ticket in Jira, and post a message in Slack
Needs changesNeeds changes. This template uses 1 thing(s) that n8n 3.0 removes: Item Lists (legacy). 1 breaking item(s) found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 13 nodes and runs on a schedule (every day). Along the way it connects Jira Software and Slack. It also calls api.us-2.crowdstrike.com over HTTP.
How it runs
Trigger: On a schedule (every day).
- Get recent detections from Crowdstrike (HTTP Request): calls api.us-2.crowdstrike.com
- Split out detections (Item Lists): reshapes item lists (legacy Item Lists node)
- Get detection details (HTTP Request): calls api.us-2.crowdstrike.com (POST)
- Split In Batches (Loop Over Items (Split in Batches)): loops over the items in batches
- Split out behaviours (Item Lists): reshapes item lists (legacy Item Lists node)
- Pause 1 second (Wait): pauses before continuing
- Look up SHA in Virustotal (HTTP Request): calls an HTTP API
- Look up IOC in Virustotal (HTTP Request): calls an HTTP API
- Set behaviour descriptions (Edit Fields (Set)): sets or maps fields
- Merge behaviour descriptions (Item Lists): reshapes item lists (legacy Item Lists node)
…plus 2 more steps. See the full node list below.
Services it uses
HTTP calls to: api.us-2.crowdstrike.com
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- Item Lists (legacy) in Split out detections, Split out behaviours, Merge behaviour descriptions: replace with Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used).
| Removed in 3.0 | Replace with |
|---|---|
| Item Lists (legacy) Split out detections, Split out behaviours, Merge behaviour descriptions | Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used) |
Nodes used (8)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Item Lists
n8n-nodes-base.itemLists - HTTP Request
n8n-nodes-base.httpRequest - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - Edit Fields (Set)
n8n-nodes-base.set - Jira Software
n8n-nodes-base.jira - Slack
n8n-nodes-base.slack - Wait
n8n-nodes-base.wait
From the author
This n8n workflow automates the handling of security detections from CrowdStrike, streamlining incident response and notification processes. The workflow is triggered daily at midnight by the Schedule Trigger node. It begins by fetching recent security…