# CrowdStrike Alerts Training

#### Generic help for the platform and be able to respond to basic alerts

- We receive pings in Channel "Technical - All" for CrowdStrike Alerts.
- Look for Hostname
- Reply to the post to say you are investigating
- or ping Matt for the associated ticket to assign to me

\*Escalate to Liam for assistance\*

- Log into Crowdstrike
- Click on New Detections (default filters to new)
- Find the alert with the associated hostname
- Status > Edit Status > In Progress > Assign to Yourself > Update Status 
    - it will then move to the in progress filter
- Click on severity to pop out more information 
    - click on network contain if it is a threat to other machines
    - once resolved click edit status, set the tag, and a comment, change status to closed, and update
- If true positive, escalate and advise the customer
- do not create any exclusions, escalate to Liam if you believe it is recurring