CrowdStrike Falcon v2.12.3
The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.
- Author:
- Cortex XSOAR
- Support:
- xsoar
Classifiers (6)
Incident fields (61)
- Behaviour Objective
- Behaviour Scenario
- Behaviour Tactic
- CrowdStrike Falcon Actor slug
- CrowdStrike Falcon Alleged File Type
- CrowdStrike Falcon At Accounts
- CrowdStrike Falcon Behaviour Pattern Disposition Details
- CrowdStrike Falcon Bios Manufacturer
- CrowdStrike Falcon Bios Version
- CrowdStrike Falcon Crawled Timestamp
- CrowdStrike Falcon Data Domains
- CrowdStrike Falcon Detection Type
- CrowdStrike Falcon Enrichments
- CrowdStrike Falcon Firmware Build Fingerprint
- CrowdStrike Falcon Firmware Build Time
- CrowdStrike Falcon IOC CVES
- CrowdStrike Falcon IOC Domains
- CrowdStrike Falcon IOC Emails
- CrowdStrike Falcon IOC Hashtags
- CrowdStrike Falcon IOC Types
- CrowdStrike Falcon IOC Urls
- CrowdStrike Falcon Item Author ID
- CrowdStrike Falcon Item author
- CrowdStrike Falcon Item date
- CrowdStrike Falcon Item id
- CrowdStrike Falcon Item site
- CrowdStrike Falcon Item site ID
- CrowdStrike Falcon Item type
- CrowdStrike Falcon Lead Id
- CrowdStrike Falcon Lead Type
- CrowdStrike Falcon Macros CMD line
- CrowdStrike Falcon Macros Display Name
- CrowdStrike Falcon Macros IOC Description
- CrowdStrike Falcon Macros IOC Source
- CrowdStrike Falcon Macros IOC Type
- CrowdStrike Falcon Mitre Attack
- CrowdStrike Falcon Mobile Manufacturer
- CrowdStrike Falcon Mobile Product
- CrowdStrike Falcon Mobile platform version
- CrowdStrike Falcon Pattern ID
- CrowdStrike Falcon Platform Name
- CrowdStrike Falcon Product Type Description
- CrowdStrike Falcon Request Parameters
- CrowdStrike Falcon Resource Attributes
- CrowdStrike Falcon Response Elements
- CrowdStrike Falcon Role ID
- CrowdStrike Falcon Role creator UID
- CrowdStrike Falcon Role creator name
- CrowdStrike Falcon Role priority
- CrowdStrike Falcon Role topic
- CrowdStrike Falcon Scan Id
- CrowdStrike Falcon Scan Name
- CrowdStrike Falcon Security patch level
- CrowdStrike Falcon Service Type
- CrowdStrike Falcon System Manufacturer
- CrowdStrike Falcon System Product Name
- CrowdStrike Falcon User Agent
- CrowdStrike Falcon User Identity
- CrowdStrike Falcon Vertex ID
- CrowdStrike Falcon Vertex Type
- Grand Parent Process
Incident types (15)
- CrowdStrike Falcon Detection
- CrowdStrike Falcon IDP Detection
- CrowdStrike Falcon IOA Event
- CrowdStrike Falcon IOM Event
- CrowdStrike Falcon Incident
- CrowdStrike Falcon Intelligence Recon notification
- CrowdStrike Falcon Mobile Detection
- CrowdStrike Falcon NGSIEM Automated Lead
- CrowdStrike Falcon NGSIEM Case
- CrowdStrike Falcon NGSIEM Detection
- CrowdStrike Falcon NGSIEM Incident
- CrowdStrike Falcon OFP Detection
- CrowdStrike Falcon On-Demand Scans Detection
- CrowdStrike Falcon Third Party Detection
- Crowdstrike Command And Scripting
Integrations (1)
Layouts (1)
Playbooks (15)
- CrowdStrike Falcon - False Positive Incident Handling
- CrowdStrike Falcon - Get Detections by Case
- CrowdStrike Falcon - Get Detections by Incident Deprecated
- CrowdStrike Falcon - Get Endpoint Forensics Data
- CrowdStrike Falcon - Retrieve File
- CrowdStrike Falcon - SIEM ingestion Get Incident Data
- CrowdStrike Falcon - Search Endpoints By Hash
- CrowdStrike Falcon - Search Endpoints By Indicators
- CrowdStrike Falcon - T1059 - Command and Scripting Interpreter
- CrowdStrike Falcon - True Positive Incident Handling
- CrowdStrike Falcon Malware - Incident Enrichment
- CrowdStrike Falcon Malware - Investigation and Response
- CrowdStrike Falcon Malware - Verify Containment Actions
- Crowdstrike Falcon - Isolate Endpoint
- Crowdstrike Falcon - Unisolate Endpoint
Scripts (12)
- ConvertEnrichmentsToTable
- ConvertRequestParametersToTable
- ConvertResourceAttributesToTable
- ConvertResponseElementsToTable
- ConvertUserIdentityToTable
- CsFalconLiftHostContainment
- ReadNetstatFile
- ReadProcessesFile
- TransformIndicatorToCSFalconIOC
- cspresentgrandparentprocess
- cspresentparentprocess
- cspresentpolicyactions
README
Endpoint security is at the frontline to protect against malicious cybersecurity threats. It represents one of the first places organizations look to secure their enterprise networks.
As the volume and sophistication of cybersecurity threats have increased, so has the need for more advanced endpoint security solutions.
CrowdStrike Falcon is one of the leaders in the Endpoint Protection Platform (EPP) market, and the CrowdStrike Falcon content pack provides a holistic solution for protecting enterprise endpoints and servers from malicious attacks that can seriously impact your organization.
This pack is designed to quickly detect, analyze, block, and contain malicious attacks in progress. It also gives administrators visibility into advanced threats to speed detection and remediation response times.
What Does This Pack Do?
<~XSOAR>
-
Mirrors incidents between Cortex XSOAR and CrowdStrike Falcon incidents or detections.
</~XSOAR> - Provides real-time response features
- Assesses vulnerability
- Contains endpoints (isolation/unisolation)
<~XSOAR>
- Removes duplicate incidents
- Eliminates false positive incidents
- Enriches incidents
</~XSOAR>
Before You Start
Make sure you have the following content packs:
- Base
- Common Scripts
- Common Types
Pack Configurations
To get up and running with this pack, you must get an API client ID and secret from CrowdStrike support.