CrowdStrike Falcon - SIEM ingestion Get Incident Data

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles incident ingestion from a SIEM. The user provides the field for the incident ID or detection ID and the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type.

CrowdStrike Falcon · 17 tasks · 5 inputs · 19 outputs

Inputs

  • SIEMincidentFieldForType — The incident field that determines if this is a detection or an incident.
  • SIEMincidentFieldForID — The incident field that contains the detection ID or incident ID.
  • ScaleToSetSeverity — The severity scale in the EDR. For example, CrowdStrike uses values from 0 to 100, so the scale can be divided into ranges such as 0-20,21-40,41-60,61-80,81-100
  • SeverityValuesMapping — The mapping from the EDR severity scale to the Cortex XSOAR severity scale. For example: 0.5, 1, 2, 3,4 Possible values to use are 0,0.5, 1, 2, 3,4 which represent Unknown, Informational, Low, Medium, High, Critical.
  • OverrideSIEMSeverity — Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR (true) or keep the original severity scale as mapped by the SIEM (false).

Outputs

  • CrowdStrike.Detection.Behavior.FileName — The file name of the behavior.
  • CrowdStrike.Detection.Behavior.Scenario — The scenario name of the behavior.
  • CrowdStrike.Detection.Behavior.MD5 — The MD5 hash of the IOC of the behavior.
  • CrowdStrike.Detection.Behavior.SHA256 — The SHA256 hash of the IOC of the behavior.
  • CrowdStrike.Detection.Behavior.IOCType — The IOC type of the IOC.
  • CrowdStrike.Detection.Behavior.IOCValue — The value of the IOC.
  • CrowdStrike.Detection.Behavior.CommandLine — The command line executed in the behavior.
  • CrowdStrike.Detection.Behavior.UserName — The user name related to the behavior.
  • CrowdStrike.Detection.Behavior.SensorID — The sensor ID related to the behavior.
  • CrowdStrike.Detection.Behavior.ParentProcessID — The ID of the parent process.
  • CrowdStrike.Detection.Behavior.ProcessID — The process ID of the behavior.
  • CrowdStrike.Detection.Behavior.ID — The ID of the behavior.
  • CrowdStrike.Detection.System — The system name of the detection.
  • CrowdStrike.Detection.CustomerID — The ID of the customer (CID).
  • CrowdStrike.Detection.MachineDomain — The name of the domain of the detection machine.
  • CrowdStrike.Detection.ID — The detection ID.
  • CrowdStrike.Detection.ProcessStartTime — The start time of the process that generated the detection.
  • Endpoint — The details of the endpoint.
  • CrowdStrike.FoundDetections — Indicates whether detections were found.

Commands used

cs-falcon-list-case-summaries cs-falcon-search-detection endpoint extractIndicators setIncident

Flowchart

detection ngsiem_case Detection ngsiem_case yes Start Start Verify if case or detection Verify if case or detection Get full detection details - cs-falcon-search-detection Get full detection details cs-falcon-search-detection Get full case details - cs-falcon-list-case-summaries Get full case details cs-falcon-list-case-summaries Done Done Set Severity - setIncident Set Severity setIncident Set Severity - setIncident Set Severity setIncident Enrich endpoint details - endpoint Enrich endpoint details endpoint Set Endpoint information to layout - setIncident Set Endpoint information ... setIncident Setting and Enrichment Setting and Enrichment NGSIEM Case Severity NGSIEM Case Severity Detection Severity Detection Severity Is override SIEM severity enabled? Is override SIEM severity... Override Severity Override Severity Extract Indicators - extractIndicators Extract Indicators extractIndicators is CrowdStrike Falcon integration enabled? - IsIntegrationAvailable is CrowdStrike Falcon int... IsIntegrationAvailable CrowdStrike Falcon - Get Detections by Case - CrowdStrike Falcon - Get Detections by Case CrowdStrike Falcon - Get ... CrowdStrike Falcon - Get Dete...