Enrich CrowdStrike detections with VirusTotal and send to TheHive

Automatically enrich CrowdStrike endpoint detections with VirusTotal and create fully enriched alerts in TheHive.

When a new endpoint detection fires in CrowdStrike, this Tines story instantly creates a structured alert in TheHive and kicks off three parallel enrichment paths; checking every IP, file hash, and URL against VirusTotal. By the time your analyst opens the alert, the context is already there.

In under five minutes, you'll see how to receive detections via webhook, normalize and format the alert data, and automatically attach VirusTotal observables for IPs, hashes, and URLs, including a polling loop that waits for URL scans to complete before adding results.

🚀 Get started with Tines for free: www.tines.com/5-minute-flows

📖 Import this story directly from the Tines Library: https://www.tines.com/library/stories/1163464