In CrowdStrike Falcon, which workflow feature allows administrators to automate the remediation of threats detected on endpoints?

Real Time Response (RTR) scripts are a core component of CrowdStrike's automation capabilities, particularly within Falcon Fusion workflows. Falcon Fusion is the platform's Security Orchestration, Automation, and Response (SOAR) feature. It allows administrators to build automated playbooks that trigger in response to specific detections or incidents. These workflows can execute RTR scripts on affected endpoints to perform custom, automated remediation actions, such as deleting persistence mechanisms, removing specific files, or reversing system changes. This provides a powerful and flexible method for automating complex remediation tasks beyond standard prevention policies.

A. Incident Archival: This is an administrative function for managing the lifecycle of closed or resolved incidents. It does not perform any active threat remediation.

B. Custom Detection Rules: These are used to create custom Indicators of Attack (IOAs) for detecting specific threats or behaviors, not for remediating them.

C. Response Policies: These policies enable automated prevention and basic containment actions (e.g., Kill Process, Quarantine File). They are static configurations, not a flexible workflow feature for custom, multi-step remediation.

1. CrowdStrike

Inc. (2023). Falcon Fusion SOAR: Getting Started Guide. CrowdStrike Documentation Portal. This guide details how Falcon Fusion automates security workflows and explicitly mentions "Run a Real Time Response script" as a primary action available in automated playbooks for remediation purposes. (Section: "Actions").

2. CrowdStrike

Inc. (2023). Real Time Response: Administrator Guide. CrowdStrike Documentation Portal. This document explains that while RTR can be used manually for surgical remediation

its scripts are integrated into Falcon Fusion to "automate response actions across your enterprise." (Section: "RTR and Falcon Fusion").

3. CrowdStrike

Inc. (2023). Prevention Policy Settings Guide. CrowdStrike Documentation Portal. This document describes how response actions within prevention policies work to automatically block or quarantine threats upon detection

distinguishing these static prevention settings from the dynamic

script-based remediation offered by RTR within workflows. (Section: "Next-Gen Antivirus (NGAV)").