Updated 11 months ago
https://github.com/crowdstrike/foundry-tutorial-enrich-incidents
Learn how to use the Foundry CLI to create a Foundry app that enriches Falcon incidents with third-party data. This app adds third-party data on the Next-Gen SIEM incident details page of the Falcon console.
Updated 11 months ago
https://github.com/crowdstrike/foundry-tutorial-extension-builder
In this tutorial, you will create a Foundry app that enriches Falcon detections with third-party data. The app uses VirusTotal to scan the IP address associated with a detection and displays the data on the Next-Gen SIEM endpoint detection details page of the Falcon console.