| 1 | # [Crowdstrike Integration](https://www.crowdstrike.com/blog/tech-center/integrate-with-your-siem) |
| 2 | |
| 3 | ## Prerequisites |
| 4 | |
| 5 | Before using the Falcon SIEM Connector, you’ll want to first define the API client and set its scope. Refer to this guide (https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/) to getting access to the CrowdStrike API for setting up a new API client key. For the new API client, make sure the scope includes read access for Event streams. |
| 6 | |
| 7 | ### IMPORTANT: If you are in the Government cloud of Crowdstrike, you must open a support ticket with Crowdstrike so they can enable the Falcon SIEM Connector on their end. |
| 8 | |
| 9 |  |
| 10 | |
| 11 | ## Configuration |
| 12 | |
| 13 | The configuration for our API creds and syslog forwarder settings are stored within `/opt/crowdstrike/etc/cs.falconhoseclient.cfg`. Adjust to make your changes. **NOTE that the `api_url` , `cliend_id` , `client_secret` , and `syslog_host` will need to be updated.** Below is an example, CoPilot will take care of this for you. |
| 14 | |
| 15 | ```yaml |
| 16 | [Settings] |
| 17 | version = 3 |
| 18 | api_url = REPLACE_BASE_URL/sensors/entities/datafeed/v2 |
| 19 | request_token_url = REPLACE_BASE_URL/oauth2/token |
| 20 | app_id = SIEM-Connector-v2.0.0 |
| 21 | |
| 22 | enable_correlation_id = false |
| 23 | format_floats_as_scientific = true |
| 24 | |
| 25 | # API Client ID |
| 26 | client_id = REPLACE_CLIENT_ID |
| 27 | # API Client Secret |
| 28 | client_secret = REPLACE_CLIENT_SECRET |
| 29 | |
| 30 | # Amount of time (in seconds) we will wait for a connect to complete. |
| 31 | connection_timeout = 10 |
| 32 | # Amount of time to wait (in seconds) for a server's response headers after fully writing the request. |
| 33 | read_timeout = 30 |
| 34 | |
| 35 | # Specify partition number 0 to n or 'all' (without quote) for all partitions |
| 36 | partition = all |
| 37 | |
| 38 | http_proxy = |
| 39 | |
| 40 | # Output formats |
| 41 | # Supported formats are |
| 42 | # 1.syslog: will output syslog format with flat key=value pairs uses the mapping configuration below. |
| 43 | ; Use syslog format if CEF/LEEF output is required. |
| 44 | # 2.json: will output raw json format received from FalconHose API (default) |
| 45 | output_format = syslog |
| 46 | |
| 47 | # Will be true regardless if Syslog is not enabled |
| 48 | # If path does not exist or user has no permission, log file will be used |
| 49 | output_to_file = false |
| 50 | output_path = /var/log/crowdstrike/falconhoseclient/output |
| 51 | |
| 52 | # Offset file full filepath and filename |
| 53 | offset_path = /var/log/crowdstrike/falconhoseclient/stream_offsets |
| 54 | |
| 55 | [Output_File_Rotation] |
| 56 | # If the output is writing to a file, then the settings below will govern output file rotation |
| 57 | # |
| 58 | # If true, then the rotation rules will apply. If not, the client will continue to write to the same file. |
| 59 | rotate_file = true |
| 60 | # Maximum individual output file size in MB |
| 61 | max_size = 500 |
| 62 | # Number of backups of the output file to be stored |
| 63 | max_backups = 10 |
| 64 | # Maximum age of backup output files before it is deleted in DAYS |
| 65 | max_age = 30 |
| 66 | |
| 67 | [Logging] |
| 68 | verbose_log = true |
| 69 | # Maximum individual log file size in MB |
| 70 | max_size = 500 |
| 71 | # Number of backups to be stored |
| 72 | max_backups = 10 |
| 73 | # Maximum age of backup files before it is deleted in DAYS |
| 74 | max_age = 30 |
| 75 | |
| 76 | [Syslog] |
| 77 | send_to_syslog_server = true |
| 78 | host = REPLACE_SYSLOG_HOST |
| 79 | port = REPLACE_SYSLOG_PORT |
| 80 | protocol = tcp |
| 81 | ``` |
| 82 | |
| 83 | ## Provisioning |
| 84 | |
| 85 | Once you have saved the Crowdstrike configuration for the customer, you are ready to deploy the integration. Navigate to the `Customers` tab and select the appropriate customer. The provisiong creates the necessary: |
| 86 | |
| 87 | - Graylog CEF Input |
| 88 | - Graylog Stream |
| 89 | - Graylog Index |
| 90 | - Grafana Datasource |
| 91 | - Grafana Dashboards |
| 92 | - Crowdstrike Docker-Compose File |
| 93 | |
| 94 | ## Deployment of Crowdstrike Container |
| 95 | |
| 96 | The Crowdstrike integration runs via a docker container. During provisioning, the following directory is created `/opt/CoPilot/data/data/CUSTOMER_NAME`. Within this directory will reside the `CUSTOMER_NAME_docker-compose.yml` and the `cs.falconhoseclient.cfg` files. These can be modified if desired but should already contain the details needed to collect logs for their Crowdstrike environment. |
| 97 | |
| 98 | Start the container with the below command: |
| 99 | |
| 100 | ```bash |
| 101 | docker compose -f /opt/CoPilot/data/data/CUSTOMER_NAME/CUSTOMER_NAME_docker-compose.yml up -d |
| 102 | ``` |
| 103 | |
| 104 | You should now see the container running: |
| 105 |  |