Splunk SOAR Playbooks: Crowdstrike Malware Triage

The combination of Crowdstrike and Splunk Phantom together allows for a more smooth operational flow from detecting endpoint security alerts to operationalizing threat intelligence and automatically taking the first few response steps - all in a matter of seconds. In this video, distinguished Phantom engineer Philip Royer will walk you through an out-of-the-box playbook that you can set up in Phantom to triage malware detections from Crowdstrike and automate a variety of responses based on an informed decision by an analyst.
To learn more, visit splunk.com/phantom

[@jmsazboy]

Guys, that was REALLY COOL!!! Great work Phil!

[@blackboy424]

Modify your resolution for future post... we can barely make out the tile names. Or zoom into the tiles as needed...

[@thegreatkris24]

Great video all around

[@therandyace]

how can I learn how to do more things like this without paying an arm and a leg for a class?

[@bradgrandorff1058]

Download the software, hit the forums, grab some python books, etc. and just start hacking away. A lab can be set up fairly easy say in Vmware, and you are off and running.

[@rbchoyce]

yes yes yes