Torq and Crowdstrike | Torq

CrowdStrike XDR Powered by Torq Hyperautomation™

Automate your manual security processes

Real-Time Threat Enrichment

Collect, analyze and organize CrowdStrike detections while automatically correlating IOCs from other security solutions or third-party threat intel, turning standalone detections into intelligently enriched cases.

Streamline Incident Response

When an incident or detection is flagged by CrowdStrike, receive real-time event data directly from CrowdStrike webhooks that enable you to gather crucial details instantly and automate actions within CrowdStrike’s Real Time Response platform.

Ready-Made CrowdStrike Automation Templates

Accelerate your security initiatives with Torq’s pre-built templates. Instantly deploy workflows for handling IOCs, identifying CVE-impacted hosts, sandboxing files, and more. With Torq, you can effortlessly manage Falcon agents, ensuring optimal security posture across your environment.

Automate Suspicious File Investigation and Remediation

Automatically validate files involved in each new EDR detection by automatically pulling all relevant detection IDs to cross-reference in Falcon Sandbox or Virus Total. If a detection is found to be malicious, automate the process of adding the IOC to CrowdStrike’s blacklist, blocking further executions or access.

Learn More

Torq Trigger

Inbound events into Torq in JSON format

Torq Workflow

Workflow started from either a CrowdStrike trigger or other event

Use no-code/low-code to query CrowdStrike API if needed

Do other tasks – Open Tickets/Send Notifications (Slack/Teams/etc)

Updated CrowdStrike elements via API if needed

Crowdstrike Detections or Incidents identified in Crowdstrike and Sent to Torq

CrowdStrike Webhooks

for Detections/Incidents

CrowdStrike APIs

Hosts/Detections/Incidents/Policies/Etc

Torq will query the Crowdstrike APIs where needed in the logic of the workflow. This could be to gather additional agent information, policy details, LogScale, or look for devices that have specific vulnerabilities.