Skip to main content
Solved

Crowdstrike - Execute Command Action Hanging

  • April 7, 2025
  • 2 replies
  • 42 views

d_patel_dj
Forum|alt.badge.img+3

Hi there, 

I am having trouble with the Crowdstrike action in Secops SOAR - specifically the execute command action. I am having the action remove a file from an endpoint, which the action successfully runs. However, the playbook appears to hang on the action and does not progress further into the playbook once the command has been executed. 

Anyone experienced this issue before? 

Thanks

Best answer by ylandovskyy

Hey @d_patel_dj ,

Make sure to check that the action is configured correctly. In this case, the root cause to the "hanging" can be the fact that "Async Polling Interval" is set to a big value. By default, platform puts there "1 hour", meaning that the action is going to fetch for an update, once in an hour. 

You can update this in the IDE or inside the playbook configuration: 

We will have an adoption guide soon, going into the details of actions. It will be described there in more details, so stay tuned. Let me know, if it helped. Thanks

 

 

 

 

 

 

2 replies

ylandovskyy
Staff
Forum|alt.badge.img+16
  • Staff
  • Answer
  • April 7, 2025

Hey @d_patel_dj ,

Make sure to check that the action is configured correctly. In this case, the root cause to the "hanging" can be the fact that "Async Polling Interval" is set to a big value. By default, platform puts there "1 hour", meaning that the action is going to fetch for an update, once in an hour. 

You can update this in the IDE or inside the playbook configuration: 

We will have an adoption guide soon, going into the details of actions. It will be described there in more details, so stay tuned. Let me know, if it helped. Thanks

 

 

 

 

 

 


d_patel_dj
Forum|alt.badge.img+3
  • Author
  • Bronze 1
  • April 7, 2025

Thank you for this!