Avoiding end point detection notification storms

Hey fellow CrowdStrikers,

We’ve got a few fusion workflows configured with the “EPP Detection” as the trigger. Email/teams/slack/PagerDuty etc all working fine

We’ve had a couple of instances where we get multiple detections from a single host- test for example- 41 detections from a single host attempting a system restore which CrowdStrike did not like.

We got 41 teams messages and 41 PagerDuty tickets

Got me wondering if there’s some kind of rate limit functionality, or “group detections by host over last 5 mins” kind of work around?

In the meantime I’ve implemented an event search that looks for detections from the same sensor ID, same workflow ID and same tactic/technique over the last 5 mins and if there’s more than one, stop the workflow.

Initial tests suggests it works but I’m not sure it’s the best way as I’ve seen events take minutes to ingest.

Really hoping there’s a better solution! Any thoughts, ideas or recommendations would be appreciated.

Cheers!