Run via the staff at orchestration, AI, and automation platform Tines, the Tines library comprises pre-built workflows shared via genuine safety practitioners from around the neighborhood, all of that are unfastened to import and deploy by means of the Neighborhood Version of the platform.
Their bi-annual “You Did What with Tines?!” festival highlights one of the vital maximum attention-grabbing workflows submitted via their customers, lots of which show sensible packages of huge language fashions (LLMs) to handle advanced demanding situations in safety operations.
One fresh winner is a workflow designed to automate CrowdStrike RFM reporting. Advanced via Tom Energy, a safety analyst at The College of British Columbia, it makes use of orchestration, AI and automation to scale back the time spent on guide reporting.
Right here, we will proportion an outline of the workflow, plus a step by step information for purchasing it up and working.
The issue – time-consuming reporting
The workflow’s builder, Tom Energy, explains, “The CrowdStrike Falcon sensor is going into Diminished Capability Mode (RFM), most often since the running device (OS) or kernel model is simply too outdated or too new for the sensor to improve in kernel mode. Each week, SecOps would log into the Falcon console, and clear out the host control console for endpoints in RFM for the closing week. We’d generate the record and obtain it.”
This procedure supplied vital information for figuring out kernel updates inflicting RFM, in particular for Linux endpoints. Alternatively, it required the staff to manually take a look at whether or not CrowdStrike had launched a brand new sensor model appropriate with the newest kernel updates.
“All the procedure took about half-hour every week,” Tom provides. “Over the process a yr, that added as much as greater than 25 hours of time we may have spent on different cybersecurity priorities.”
The answer – automatic RFM reporting with AI
Tom’s workflow automates the monitoring and reporting of Falcon Sensor RFM throughout hosts. By way of leveraging Tines’ AI-driven Automated Mode, it generates customized code to streamline record advent. The workflow no longer handiest produces common, constant studies but additionally allows control to observe traits in RFM occurrences, supporting proactive device well being control and quicker decision-making.
The automatic workflow gets rid of the desire for guide reporting via permitting analysts to put up requests by means of a easy internet shape. Inside of mins, the workflow retrieves information, processes it, and delivers an actionable electronic mail record, whole with detailed insights and a CSV attachment.
Instance output:
Here is a pattern of the auto-generated electronic mail and record won via the staff:
Listed below are one of the vital key advantages of the usage of this workflow:
- Frees analysts to concentrate on high-priority cybersecurity duties.
- Reduces guide effort and the possibility of human error.
- Delivers constant, dependable studies for advanced productiveness.
- Complements decision-making via offering real-time insights.
- Boosts morale via disposing of a tedious and repetitive process.
Workflow evaluate
Equipment used:
- Tines – a workflow orchestration, AI and automation platform that is well-liked by safety groups. It is imaginable to make use of the unfastened Neighborhood Version of Tines to construct and run this workflow should you shouldn’t have a paid account. AI will have to be enabled in your tenant.
- CrowdStrike – endpoint detection and reaction (EDR) platform. This workflow integrates with CrowdStrike Falcon’s API to retrieve information about endpoints in Diminished Capability Mode (RFM). Whilst Falcon supplies tough endpoint visibility, it lacks local automation for ordinary RFM studies.
The workflow is initiated when a internet shape is submitted, triggering the method to generate CrowdStrike RFM studies.
The primary motion retrieves an inventory of software IDs from CrowdStrike Falcon’s API. If the listing is bigger than what CrowdStrike returns within the first batch, a couple of calls are made to paginate in the course of the complete listing.
As soon as all of the software main points are retrieved, the workflow consolidates them right into a unmarried useful resource. This useful resource acts as the basis for research, the place the choice of Linux, Home windows, and Mac hosts is calculated and appended to the information.
The usage of the consolidated useful resource, the workflow generates an HTML abstract desk to offer the information in a structured layout. This desk is then transformed right into a CSV document, making it appropriate for reporting functions.
The CSV record is emailed to stakeholders for evaluation. To care for potency and information hygiene, the workflow purges the brief useful resource after the e-mail is shipped, making sure it’s in a position for the following cycle.
By way of automating those steps, the workflow gets rid of guide effort, reduces the chance of mistakes, and offers constant, up-to-date reporting on gadgets in diminished capability mode around the surroundings.
Configuring the workflow – step by step information
- Log into Tines or create a brand new account.
- Make sure that AI is enabled in your tenant. For this, you wish to have to be the tenant proprietor. Choose the account settings drop-down within the best left of your display, and take a look at the field to show AI on.
- Create your CrowdStrike credential. From the credentials web page, make a choice New credential, scroll all the way down to the CrowdStrike credential and whole the specified fields.
- Navigate to the pre-built workflow within the library.
- Choose import. This must take you instantly for your new pre-built workflow.
- Configure your movements. As an example, you could love to edit the structure of the Tines web page that kicks off the workflow.
- Check the workflow. Publish a picture by means of the shape to check your workflow.
- Put up your workflow and proportion the Web page URL along with your desired customers.
Development in different automation platforms
You need to use some other no-code automation platform to construct a an identical provider, even if it is value noting that one of the vital options on this workflow are distinctive to Tines:
- Pages: This workflow is kicked off via a submission to a kind on a internet web page. That is constructed the usage of Tines’ Pages characteristic.
- Choice: Use a scheduled cause to kick off the workflow.
- Match Turn into in Automated Mode: This selection makes use of build-time AI to compose Python code according to the steering and the enter the builder supplies. While you save your adjustments, the code is locked in position. Which means when the motion runs, handiest the code executes, and no AI is concerned.
- Choice: Write Python code manually to become your information.
If you need to discover AI in Tines for your self or take a look at out this workflow, you’ll join a unfastened account together with AI capability.