{
  "openruna_format": "flow-graph-v1",
  "title": "Analyze_Crowdstrike_Detections__search_for_IOCs_in_VirusTotal__create_a_ticket_in_Jira_and_post_a_message_in_Slack",
  "slug": "analyze-crowdstrike-detections-search-for-iocs-in-virustotal-create-a-ticket-in-jira-and-post-a-message-in-slack",
  "source_filename": "1312_Wait_Schedule_Create_Webhook.json",
  "nodes": [
    {
      "id": "Schedule Trigger",
      "name": "Schedule Trigger",
      "integration": "schedule",
      "kind": "trigger"
    },
    {
      "id": "Split out detections",
      "name": "Split out detections",
      "integration": "itemLists",
      "kind": "logic"
    },
    {
      "id": "Get recent detections from Crowdstrike",
      "name": "Get recent detections from Crowdstrike",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Get detection details",
      "name": "Get detection details",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Split out behaviours",
      "name": "Split out behaviours",
      "integration": "itemLists",
      "kind": "logic"
    },
    {
      "id": "Look up SHA in Virustotal",
      "name": "Look up SHA in Virustotal",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Look up IOC in Virustotal",
      "name": "Look up IOC in Virustotal",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Split In Batches",
      "name": "Split In Batches",
      "integration": "splitInBatches",
      "kind": "logic"
    },
    {
      "id": "Merge behaviour descriptions",
      "name": "Merge behaviour descriptions",
      "integration": "itemLists",
      "kind": "logic"
    },
    {
      "id": "Set behaviour descriptions",
      "name": "Set behaviour descriptions",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Create Jira issue",
      "name": "Create Jira issue",
      "integration": "jira",
      "kind": "action"
    },
    {
      "id": "Post notification on Slack",
      "name": "Post notification on Slack",
      "integration": "slack",
      "kind": "action"
    },
    {
      "id": "Pause 1 second",
      "name": "Pause 1 second",
      "integration": "wait",
      "kind": "logic"
    }
  ],
  "edges": [
    {
      "from": "Pause 1 second",
      "to": "Look up SHA in Virustotal"
    },
    {
      "from": "Schedule Trigger",
      "to": "Get recent detections from Crowdstrike"
    },
    {
      "from": "Split In Batches",
      "to": "Split out behaviours"
    },
    {
      "from": "Create Jira issue",
      "to": "Post notification on Slack"
    },
    {
      "from": "Split out behaviours",
      "to": "Pause 1 second"
    },
    {
      "from": "Split out detections",
      "to": "Get detection details"
    },
    {
      "from": "Get detection details",
      "to": "Split In Batches"
    },
    {
      "from": "Look up IOC in Virustotal",
      "to": "Set behaviour descriptions"
    },
    {
      "from": "Look up SHA in Virustotal",
      "to": "Look up IOC in Virustotal"
    },
    {
      "from": "Post notification on Slack",
      "to": "Split In Batches"
    },
    {
      "from": "Set behaviour descriptions",
      "to": "Merge behaviour descriptions"
    },
    {
      "from": "Merge behaviour descriptions",
      "to": "Create Jira issue"
    },
    {
      "from": "Get recent detections from Crowdstrike",
      "to": "Split out detections"
    }
  ]
}