category: Endpoint
provider: CrowdStrike
commonfields:
  id: CrowdStrike Falcon Streaming v2
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.crowdstrike.com
  display: Cloud Base URL (e.g., https://api.crowdstrike.com)
  name: base_url
  required: true
  section: Connect
  type: 0
- display: Client ID
  name: client_id
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Client Secret
  name: client_secret
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Client ID
  name: credentials_client
  type: 9
  displaypassword: Client Secret
  section: Connect
  required: false
- additionalinfo: Allows running multiple clients (stream consumers) simultaneously, as each integration instance needs a unique application ID. Must be a max. of 32 alphanumeric characters (a-z, A-Z, 0-9).
  defaultvalue: Demisto
  display: Application ID
  name: app_id
  type: 0
  section: Connect
  required: false
- defaultvalue: 'true'
  display: Long running instance
  hidden: true
  name: longRunning
  type: 8
  section: Connect
  required: false
- defaultvalue: EppDetectionSummaryEvent
  display: Event type to fetch
  name: event_type
  options:
  - AuthActivityAuditEvent
  - CustomerIOCEvent
  - UserActivityAuditEvent
  - Event_ExternalApiEvent
  - RemoteResponseSessionEndEvent
  - EppDetectionSummaryEvent
  type: 16
  section: Collect
  required: false
- defaultvalue: '0'
  display: Offset to fetch events from
  name: offset
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- defaultvalue: 1 hour
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  section: Collect
  type: 0
  required: false
- additionalinfo: The maximal number of seconds to wait between reads from the stream. To disable the timeout, set to 0.
  defaultvalue: '120'
  display: Stream client read timeout
  name: sock_read_timeout
  type: 0
  section: Collect
  required: false
- additionalinfo: As this is a push-based streaming integration, it cannot fetch sample events in the mapping wizard. To view sample events, you need to enable events storage and run the crowdstrike-falcon-streaming-get-sample-events command. After you finish mapping, it is recommended to turn off the sample events storage to reduce performance overhead.
  display: Store sample events for mapping
  name: store_samples
  type: 8
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
description: Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events.
display: CrowdStrike Falcon Streaming v2
name: CrowdStrike Falcon Streaming v2
script:
  commands:
  - description: Returns a list of sample events fetched from the stream.
    name: crowdstrike-falcon-streaming-get-sample-events
  dockerimage: demisto/py3-tools:1.0.0.4257568
  isFetchSamples: true
  longRunning: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No test
defaultmapperin: crowdstrike-streaming-api-mapper
defaultclassifier: crowdstrike-streaming-api
fromversion: 5.0.0