--- title: Automated Blocking of Malicious File Hashes and Endpoint Isolation on Crowdstrike Falcon description: The Block Malicious File Hash and Isolate Endpoint on Crowdstrike Falcon playbook automates the response to malware alerts, ensuring swift containment and remediation. By integrating threat intelligence and endpoint security tools, this playbook enables proactive incident handling, minimizing the potential spread and impact of malware. --- [Skip to content](https://content.sirp.io/knowledge-base/automated-blocking-of-malicious-file-hashes-and-endpoint-isolation-on-crowdstrike-falcon-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) # Automated Blocking of Malicious File Hashes and Endpoint Isolation on Crowdstrike Falcon Automate malware response with hash blocking and endpoint isolation using Virus Total, Crowdstrike Falcon, and SIRP integrations ### **Introduction** The **Block Malicious File Hash and Isolate Endpoint on Crowdstrike Falcon** playbook automates the response to malware alerts, ensuring swift containment and remediation. By integrating threat intelligence and endpoint security tools, this playbook enables proactive incident handling, minimizing the potential spread and impact of malware. ### **Challenges Faced** - **Delayed Containment:** Manual investigation and response to malware alerts prolong the containment process. - **Coordination Overhead:** Communication gaps between the SOC team and asset owners can delay further analysis. - **Risk of Malware Propagation:** Uncontained endpoints can lead to lateral movement and escalate incidents. ### **How SIRP Solves This** This playbook provides a structured and automated approach to respond to malicious file hashes detected in malware alerts. 1. **Hash Reputation Check** - The playbook fetches the reported file hash from the alert and calls **Virus Total** to verify its reputation. 2. **Hash Blocking** - If the hash is identified as malicious, it is immediately blocked on **Crowdstrike Falcon**, preventing its execution across managed endpoints. 3. **Endpoint Isolation** - The playbook fetches the affected asset (hostname) details from the alert and isolates the endpoint (host) via Crowdstrike Falcon, ensuring the malware does not spread further. 4. **Notification to SOC Team** - SOC analysts are notified to contact the asset owner for further analysis, remediation, and to assess potential collateral damage. ### **Playbook Prerequisites** - **SIEM/EDR Alert Configuration:** Malware alerts should be configured and ingested into SIRP. - **EDR Capabilities:** Ensure the endpoint detection and response tool supports hash blocking and host containment. - **Virus Total Integration:** To fetch and verify hash reputations. ### **Playbook Integrations** - **Virus Total:** Fetches and verifies the reputation of file hashes. - **Crowdstrike Falcon:** Blocks malicious hashes and isolates endpoints. - **SIRP:** Manages alert updates, workflows, and notifications. ### **Playbook Inputs** - **Hostname:** The name of the affected host in the alert. - **Hash:** The malicious file hash reported in the alert. ### **Playbook Outputs** - **Block Hash:** Prevents the malicious file hash from being executed on endpoints. - **Contain Host:** Isolates the affected endpoint to stop malware propagation. - **Send Notification to Analyst:** Notifies the SOC team to coordinate further actions. ### **The SIRP Playbook** [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/marketplace-playbook_2022-11-11-17_18_40.png)](https://downloads.intercomcdn.com/i/o/ffsl1ew6/1296241996/2789b5af513aadb0d03e61ac4e94/marketplace-playbook_2022-11-11-17_18_40.png?expires=1752237000&signature=3282fc95a898dac49c7517abfb01cf5c3e43a53255bf16498c776d37a8d324c6&req=dSIuEMt6nIhWX%2FMW1HO4zRcQ7XlsYNmJAsZd6g7zRKd5L0dRrxRCuxXXv73D%0AKzMpNWon7DjJqN%2B0C0A%3D%0A) ### **Key Benefits** - **Accelerated Malware Response:** Automates critical containment steps, reducing response time. - **Enhanced Security Posture:** Prevents malware execution and lateral movement by isolating compromised endpoints. - **Streamlined Communication:** Ensures SOC teams are promptly informed for follow-up actions. - **Integration-Driven Efficiency:** Combines Virus Total, Crowdstrike Falcon, and SIRP to deliver seamless incident handling. ### **FAQs** 1. **What happens if a hash is not found malicious?** - The playbook can be configured to flag the alert for further manual investigation by the SOC team. 2. **Can this playbook support other EDR tools besides Crowdstrike Falcon?** - Yes, the playbook can be adapted to integrate with other EDR tools that support similar functionalities. 3. **Does the playbook notify asset owners?** - Notifications are sent to the SOC team, who can coordinate with the asset owner as needed. - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc