CrowdStrike Alerts Training

Generic help for the platform and be able to respond to basic alerts

• We receive pings in Channel "Technical - All" for CrowdStrike Alerts. 
• Look for Hostname
• Reply to the post to say you are investigating
• or ping Matt for the associated ticket to assign to me 

*Escalate to Liam for assistance*

• Log into Crowdstrike
• Click on New Detections (default filters to new)
• Find the alert with the associated hostname
• Status > Edit Status > In Progress > Assign to Yourself > Update Status
  • it will then move to the in progress filter
• Click on severity to pop out more information
  • click on network contain if it is a threat to other machines
  • once resolved click edit status, set the tag, and a comment, change status to closed, and update
• If true positive, escalate and advise the customer
• do not create any exclusions, escalate to Liam if you believe it is recurring