CrowdStrike Falcon Streaming v2

Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events.

Details

ID	`CrowdStrike Falcon Streaming v2`
Provider	CrowdStrike
Category	Endpoint
From Version	5.0.0
Docker Image	`demisto/py3-tools:1.0.0.4257568`

README

Overview

Use CrowdStrike Falcon Streaming v2 integration to connect to CrowdStrike Falcon stream and fetch events as incidents to Cortex XSOAR.

Define CrowdStrike API client

In order to use the integration, an API client need to be defined, and its ID and secret should be configured in the integration instance.

Follow this article in order to get access to CrowdStrike API, and generate client ID and client secret.

The required scope is Event streams.

Configure CrowdStrike Falcon Streaming v2 on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for CrowdStrike Falcon Streaming v2
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Cloud Base URL (e.g. https://api.crowdstrike.com)
- Client ID
- Client Secret
- Application ID
- Event type to fetch
- Offset to fetch events from
- Stream client read timeout
- Incident type
- Store sample events for mapping
- Trust any certificate (not secure)
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Important Notes

If you’re using Falcon’s commercial cloud, use the default value of the Cloud base URL.
If you use another CrowdStrike cloud environment, use one of the following:
- GovCloud: https://api.laggar.gcw.crowdstrike.com
- EU cloud: https://api.eu-1.crowdstrike.com
Offset to fetch events from should have an integer value, in order to fetch all events set it to 0 (as the default value).

Only events starting from this offset will be fetched

For example, if set to 10: the event with offset 9 will not be fetched, and events with offsets 10 and 11 will be fetched.
Event type to fetch parameter accepts multiple values, so choose as many as you want to fetch.

In order to fetch all events of all types, you can leave it empty.

You can also add event type that is not listed, by entering it in the parameter value.
In order to run multiple clients (stream consumers) simultaneously, each integration instance should have unique application ID. The application ID can be of length up to 32 characters.

Fetched Incidents Data

Event metadata will be fetched as the incident details, which contain the following:

Type
Offset
Creation time
Used ID
Service Name
Detection Name
Detection Description
Severity

Mapping incoming events

Because this is a push-based streaming integration, it cannot fetch sample events in the mapping wizard.

In order to view sample events, enable events storage by selecting the checkbox of the integration parameter Store sample events for mapping.

The last events (maximum of 20) are fetched every 1 minute. Allow the integration to run for at least 5 minutes before running the command.
After you finish mapping, it is recommended to turn off the Store sample events for mapping to reduce performance overhead.

For Cortex XSOAR version 6.0 and above, you will be able to fetch samples in the mapping wizard

For earlier versions, you should run the crowdstrike-falcon-streaming-get-sample-events command.

The command output is as follows:

{
    "event": {
        "ComputerName": "FALCON-CROWDSTR",
        "DetectId": "ldt:15dbb9d8f06b45fe9f61eb46e829d986:55929758895",
        "DetectName": "Suspicious Activity",
        "FileName": "choice.exe",
        "FilePath": "\\Device\\HarddiskVolume1\\Windows\\System32",
        "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE",
        "GrandparentImageFileName": "\\Device\\HarddiskVolume1\\Windows\\explorer.exe",
        "MD5String": "463b5477ff96ab86a01ba49bcc02b539",
        "MachineDomain": "FALCON-CROWDSTR",
        "Objective": "Falcon Detection Method",
        "ParentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ",
        "ParentImageFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\cmd.exe",
        "ParentProcessId": 79569204402,
        "PatternDispositionDescription": "Detection, standard detection.",
        "PatternDispositionFlags": {
            "BootupSafeguardEnabled": false,
            "CriticalProcessDisabled": false,
            "Detect": false,
            "FsOperationBlocked": false,
            "InddetMask": false,
            "Indicator": false,
            "KillParent": false,
            "KillProcess": false,
            "KillSubProcess": false,
            "OperationBlocked": false,
            "PolicyDisabled": false,
            "ProcessBlocked": false,
            "QuarantineFile": false,
            "QuarantineMachine": false,
            "RegistryOperationBlocked": false,
            "Rooting": false,
            "SensorOnly": false
        },
        "PatternDispositionValue": 0,
        "ProcessEndTime": 1592479032,
        "ProcessId": 79867150228,
        "ProcessStartTime": 1592479032,
        "Severity": 2,
        "SeverityName": "Low",
        "Tactic": "Falcon Overwatch",
        "Technique": "Malicious Activity",
        "UserName": "admin"
    },
    "metadata": {
        "customerIDString": "20874a8064904ecfbb62c118a6a19411",
        "eventCreationTime": 1592479032000,
        "eventType": "EppDetectionSummaryEvent",
        "offset": 70628,
        "version": "1.0"
    }
}

You can now upload that JSON file to the mapping wizard and continue as usual.

Configuration parameters

base_url — Cloud Base URL (e.g., https://api.crowdstrike.com) (required)
client_id — Client ID
client_secret — Client Secret
credentials_client — Client ID
app_id — Application ID
longRunning — Long running instance
event_type — Event type to fetch
offset — Offset to fetch events from
incidentType — Incident type
fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
sock_read_timeout — Stream client read timeout
store_samples — Store sample events for mapping
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

crowdstrike-falcon-streaming-get-sample-events
Returns a list of sample events fetched from the stream.

Source

CrowdStrikeFalconStreamingV2.py CrowdStrikeFalconStreamingV2_test.py CrowdStrikeFalconStreamingV2.yml CrowdStrikeFalconStreamingV2_description.md

Download History Raw

category: Endpoint
provider: CrowdStrike
commonfields:
  id: CrowdStrike Falcon Streaming v2
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.crowdstrike.com
  display: Cloud Base URL (e.g., https://api.crowdstrike.com)
  name: base_url
  required: true
  section: Connect
  type: 0
- display: Client ID
  name: client_id
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Client Secret
  name: client_secret
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Client ID
  name: credentials_client
  type: 9
  displaypassword: Client Secret
  section: Connect
  required: false
- additionalinfo: Allows running multiple clients (stream consumers) simultaneously, as each integration instance needs a unique application ID. Must be a max. of 32 alphanumeric characters (a-z, A-Z, 0-9).
  defaultvalue: Demisto
  display: Application ID
  name: app_id
  type: 0
  section: Connect
  required: false
- defaultvalue: 'true'
  display: Long running instance
  hidden: true
  name: longRunning
  type: 8
  section: Connect
  required: false
- defaultvalue: EppDetectionSummaryEvent
  display: Event type to fetch
  name: event_type
  options:
  - AuthActivityAuditEvent
  - CustomerIOCEvent
  - UserActivityAuditEvent
  - Event_ExternalApiEvent
  - RemoteResponseSessionEndEvent
  - EppDetectionSummaryEvent
  type: 16
  section: Collect
  required: false
- defaultvalue: '0'
  display: Offset to fetch events from
  name: offset
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- defaultvalue: 1 hour
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  section: Collect
  type: 0
  required: false
- additionalinfo: The maximal number of seconds to wait between reads from the stream. To disable the timeout, set to 0.
  defaultvalue: '120'
  display: Stream client read timeout
  name: sock_read_timeout
  type: 0
  section: Collect
  required: false
- additionalinfo: As this is a push-based streaming integration, it cannot fetch sample events in the mapping wizard. To view sample events, you need to enable events storage and run the crowdstrike-falcon-streaming-get-sample-events command. After you finish mapping, it is recommended to turn off the sample events storage to reduce performance overhead.
  display: Store sample events for mapping
  name: store_samples
  type: 8
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
description: Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events.
display: CrowdStrike Falcon Streaming v2
name: CrowdStrike Falcon Streaming v2
script:
  commands:
  - description: Returns a list of sample events fetched from the stream.
    name: crowdstrike-falcon-streaming-get-sample-events
  dockerimage: demisto/py3-tools:1.0.0.4257568
  isFetchSamples: true
  longRunning: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No test
defaultmapperin: crowdstrike-streaming-api-mapper
defaultclassifier: crowdstrike-streaming-api
fromversion: 5.0.0