Skip to main content

CrowdStrike Alerts Training

Generic help for the platform and be able to respond to basic alerts

  • We receive pings in Channel "Technical - All" for CrowdStrike Alerts. 
  • Look for Hostname
  • Reply to the post to say you are investigating
  • or ping Matt for the associated ticket to assign to me 

*Escalate to Liam for assistance*

  • Log into Crowdstrike
  • Click on New Detections (default filters to new)
  • Find the alert with the associated hostname
  • Status > Edit Status > In Progress > Assign to Yourself > Update Status
    • it will then move to the in progress filter
  • Click on severity to pop out more information
    • click on network contain if it is a threat to other machines
    • once resolved click edit status, set the tag, and a comment, change status to closed, and update
  • If true positive, escalate and advise the customer
  • do not create any exclusions, escalate to Liam if you believe it is recurring
Back to top