@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
mdx 167 lines 4.86 KB
Raw
1 ---
2 title: CrowdStrike
3 description: Ingest CrowdStrike Falcon events using the Falcon SIEM Connector and route them into your SOCFortress SIEM stack.
4 ---
5
6 ## What this integration is
7
8 This integration ingests **CrowdStrike Falcon** events into your SOCFortress SIEM stack using the **Falcon SIEM Connector** (FalconHose).
9
10 CrowdStrike events are forwarded to your SIEM (typically Graylog) over syslog, where they can be searched, routed, and used for alerting and investigations.
11
12 Vendor references:
13 - Integrate with your SIEM: https://www.crowdstrike.com/blog/tech-center/integrate-with-your-siem
14 - Get access to Falcon APIs: https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/
15
16 ---
17
18 ## Prerequisites
19
20 - CrowdStrike Falcon console access
21 - An API client created with scope that includes **read access for Event streams**
22
23 Important:
24 - If you are in **CrowdStrike Government cloud**, you must open a support ticket with CrowdStrike to enable the Falcon SIEM Connector.
25
26 ![CrowdStrike API Settings](/assets/images/crowdstrike/crowdstrike_api_settings.png)
27
28 ---
29
30 ## Configuration (Falcon SIEM Connector)
31
32 Connector configuration is stored at:
33 - `/opt/crowdstrike/etc/cs.falconhoseclient.cfg`
34
35 CoPilot provisioning typically generates this for you, but for reference the key values that must be set include:
36 - `api_url`
37 - `client_id`
38 - `client_secret`
39 - `syslog_host` / `syslog_port`
40
41 Example configuration:
42
43 ```ini
44 [Settings]
45 version = 3
46 api_url = REPLACE_BASE_URL/sensors/entities/datafeed/v2
47 request_token_url = REPLACE_BASE_URL/oauth2/token
48 app_id = SIEM-Connector-v2.0.0
49
50 enable_correlation_id = false
51 format_floats_as_scientific = true
52
53 # API Client ID
54 client_id = REPLACE_CLIENT_ID
55 # API Client Secret
56 client_secret = REPLACE_CLIENT_SECRET
57
58 # Amount of time (in seconds) we will wait for a connect to complete.
59 connection_timeout = 10
60 # Amount of time to wait (in seconds) for a server's response headers after fully writing the request.
61 read_timeout = 30
62
63 # Specify partition number 0 to n or 'all' (without quote) for all partitions
64 partition = all
65
66 http_proxy =
67
68 # Output formats
69 # Supported formats are
70 # 1.syslog: will output syslog format with flat key=value pairs uses the mapping configuration below.
71 ; Use syslog format if CEF/LEEF output is required.
72 # 2.json: will output raw json format received from FalconHose API (default)
73 output_format = syslog
74
75 # Will be true regardless if Syslog is not enabled
76 # If path does not exist or user has no permission, log file will be used
77 output_to_file = false
78 output_path = /var/log/crowdstrike/falconhoseclient/output
79
80 # Offset file full filepath and filename
81 offset_path = /var/log/crowdstrike/falconhoseclient/stream_offsets
82
83 [Output_File_Rotation]
84 # If the output is writing to a file, then the settings below will govern output file rotation
85 #
86 # If true, then the rotation rules will apply. If not, the client will continue to write to the same file.
87 rotate_file = true
88 # Maximum individual output file size in MB
89 max_size = 500
90 # Number of backups of the output file to be stored
91 max_backups = 10
92 # Maximum age of backup output files before it is deleted in DAYS
93 max_age = 30
94
95 [Logging]
96 verbose_log = true
97 # Maximum individual log file size in MB
98 max_size = 500
99 # Number of backups to be stored
100 max_backups = 10
101 # Maximum age of backup files before it is deleted in DAYS
102 max_age = 30
103
104 [Syslog]
105 send_to_syslog_server = true
106 host = REPLACE_SYSLOG_HOST
107 port = REPLACE_SYSLOG_PORT
108 protocol = tcp
109 ```
110
111 ---
112
113 ## CoPilot provisioning
114
115 Once you have saved the CrowdStrike configuration for the customer, you are ready to deploy the integration.
116
117 In CoPilot, navigate to the **Customers** section and select the appropriate customer. Provisioning typically creates:
118 - Graylog CEF input
119 - Graylog stream
120 - Graylog index
121 - Grafana datasource
122 - Grafana dashboards
123 - CrowdStrike docker compose file
124
125 ---
126
127 ## Deployment (connector container)
128
129 The CrowdStrike integration runs via a docker container.
130
131 During provisioning, a customer directory is created:
132 - `/opt/CoPilot/data/data/<CUSTOMER_NAME>`
133
134 Inside you’ll typically find:
135 - `<CUSTOMER_NAME>_docker-compose.yml`
136 - `cs.falconhoseclient.cfg`
137
138 Start the container:
139
140 ```bash
141 docker compose -f /opt/CoPilot/data/data/<CUSTOMER_NAME>/<CUSTOMER_NAME>_docker-compose.yml up -d
142 ```
143
144 You should now see the container running:
145
146 ![CrowdStrike Running Container](/assets/images/crowdstrike/docker_ps.PNG)
147
148 ---
149
150 ## Success criteria
151
152 - [ ] CrowdStrike events are arriving in Graylog
153 - [ ] Events are routed to the correct customer stream/index
154 - [ ] Dashboards populate (after a short delay)
155
156 ---
157
158 ## Troubleshooting
159
160 - No events:
161 - verify Falcon SIEM Connector is enabled for your tenant (GovCloud note above)
162 - confirm API client has event stream read scope
163 - check connector container logs
164
165 - Events arriving but not routed:
166 - confirm Graylog input/stream/index created during provisioning
167 - confirm syslog host/port match your Graylog input