@cryptotaxi247 / CoPilot / commits / 60330497

chore: Update crowdstrike integration schema and provision logic

Taylor committed May 10, 2024 at 10:20 UTC 603304977e8c167d10e5809ea5424b420af1800e
5 files changed +1335 -5
backend/app/integrations/crowdstrike/schema/provision.py
+5 -4
@@ -1,5 +1,6 @@
1 from typing import Any
2 from typing import Dict
3 +from typing import Optional
4
5 from pydantic import BaseModel
6 from pydantic import Field
@@ -17,13 +18,13 @@ class ProvisionCrowdstrikeRequest(BaseModel):
18 description="The integration name.",
19 examples=["Crowdstrike"],
20 )
20 - hot_data_retention: int = Field(
21 - ...,
21 + hot_data_retention: Optional[int] = Field(
22 + 30,
23 example=30,
24 description="Number of days to retain hot data",
25 )
25 - index_replicas: int = Field(
26 - ...,
26 + index_replicas: Optional[int] = Field(
27 + 0,
28 example=1,
29 description="Number of replicas for the customer's Graylog instance",
30 )
backend/data/SOCFORTRESS/SOCFORTRESS_docker-compose.yml new
+8
@@ -0,0 +1,8 @@
1 +version: "3.8"
2 +
3 +services:
4 + crowdstrike-connector-SOCFORTRESS:
5 + image: ghcr.io/socfortress/crowdstrike-connector
6 + volumes:
7 + - /opt/CoPilot/data/data/SOCFORTRESS/cs.falconhoseclient.cfg:/opt/crowdstrike/etc/cs.falconhoseclient.cfg
8 + restart: unless-stopped
backend/data/SOCFORTRESS/cs.falconhoseclient.cfg new
+1280
@@ -0,0 +1,1280 @@
1 +[Settings]
2 +version = 3
3 +api_url = https://api.laggar.gcw.crowdstrike.com/sensors/entities/datafeed/v2
4 +request_token_url = https://api.laggar.gcw.crowdstrike.com/oauth2/token
5 +app_id = SIEM-Connector-v2.0.0
6 +
7 +enable_correlation_id = false
8 +format_floats_as_scientific = true
9 +
10 +# API Client ID
11 +client_id = 59b2a0df58364db2a5772b1d6f3dd60b
12 +# API Client Secret
13 +client_secret = fVR354s9rhb8a2UDdCmpGO0ikEBnxvSLcT176Ylj
14 +
15 +# Amount of time (in seconds) we will wait for a connect to complete.
16 +connection_timeout = 10
17 +# Amount of time to wait (in seconds) for a server's response headers after fully writing the request.
18 +read_timeout = 30
19 +
20 +# Specify partition number 0 to n or 'all' (without quote) for all partitions
21 +partition = all
22 +
23 +http_proxy =
24 +
25 +# Output formats
26 +# Supported formats are
27 +# 1.syslog: will output syslog format with flat key=value pairs uses the mapping configuration below.
28 +; Use syslog format if CEF/LEEF output is required.
29 +# 2.json: will output raw json format received from FalconHose API (default)
30 +output_format = syslog
31 +
32 +# Will be true regardless if Syslog is not enabled
33 +# If path does not exist or user has no permission, log file will be used
34 +output_to_file = false
35 +output_path = /var/log/crowdstrike/falconhoseclient/output
36 +
37 +# Offset file full filepath and filename
38 +offset_path = /var/log/crowdstrike/falconhoseclient/stream_offsets
39 +
40 +[Output_File_Rotation]
41 +# If the output is writing to a file, then the settings below will govern output file rotation
42 +#
43 +# If true, then the rotation rules will apply. If not, the client will continue to write to the same file.
44 +rotate_file = true
45 +# Maximum individual output file size in MB
46 +max_size = 500
47 +# Number of backups of the output file to be stored
48 +max_backups = 10
49 +# Maximum age of backup output files before it is deleted in DAYS
50 +max_age = 30
51 +
52 +[Logging]
53 +verbose_log = true
54 +# Maximum individual log file size in MB
55 +max_size = 500
56 +# Number of backups to be stored
57 +max_backups = 10
58 +# Maximum age of backup files before it is deleted in DAYS
59 +max_age = 30
60 +
61 +[Syslog]
62 +send_to_syslog_server = true
63 +host = ashgrl02.socfortress.local
64 +port = 5556
65 +protocol = tcp
66 +
67 +# CEF/LEEF Headers, header_prefix will be appended before any other header information
68 +# Within each mapping section, we can add __header.{n} (note double underscore) where n is consecutive integer
69 +# starting with 0 which will be added sequentially.
70 +# Value of headers can be:
71 +# 1. As specified: enclose by single-quote
72 +# 2. Field value: just specify which field name
73 +header_delim = |
74 +header_prefix = CEF:0|CrowdStrike|FalconHost|1.0|
75 +
76 +# Character Escaping Setting
77 +# Syntax Guidelines:
78 +# - Enclose characters with double-quote i.e. "|"
79 +# - From and To characters are delimited by colon
80 +# - Character(s) that needs to be escaped is placed on the left side of a colon (:) and character to replace with is on the right i.e. "from":"to"
81 +# - Multiple character escape setting is delimited by a common i.e. "from1":"to1","from2":"to2" and so on
82 +# - header_prefix setting (above) will not be escaped
83 +escape_header = "|":"\|","\\":"\\\\"
84 +escape_ext = "\\":"\\\\","=":"\=","\n":"\\n","\r":"\\r"
85 +
86 +# Delimiter separating key and value, example: if the delimiter is '='(equal): filename=abc.txt
87 +key_val_delim = =
88 +
89 +# Delimiter separating 2 key-value pairs , example: if the delimiter is ','(comma): filename=abc.txt,domain=www.google.com
90 +# Note: For space just leave it empty
91 +field_delim =
92 +
93 +val_enclosure =
94 +
95 +# These fields will be converted to time format, field name should be the key on the mapping section (RFC3339)
96 +time_fields = deviceCustomDate1
97 +time_format = MMM dd yyyy HH:mm:ss
98 +
99 +# This will be use for filtering
100 +event_type_field = metadata.eventType
101 +event_subtype_field = event.subType
102 +
103 +# Max length of syslog line in bytes
104 +max_length = 2048
105 +
106 +# Send retry interval in seconds (applicable only for TCP)
107 +retry_interval_secs = 10
108 +
109 +# Static order fields
110 +keys_ordered = true
111 +
112 +[EventTypeCollection]
113 +DetectionSummaryEvent = true
114 +AuthActivityAuditEvent = true
115 +UserActivityAuditEvent = true
116 +HashSpreadingEvent = true
117 +RemoteResponseSessionStartEvent = true
118 +RemoteResponseSessionEndEvent = true
119 +FirewallMatchEvent = true
120 +CSPMSearchStreamingEvent = true
121 +CSPMIOAStreamingEvent = true
122 +IncidentSummaryEvent = true
123 +CustomerIOCEvent = true
124 +IdentityProtectionEvent = true
125 +ReconNotificationSummaryEvent = true
126 +ScheduledReportNotificationEvent = true
127 +MobileDetectionSummaryEvent = true
128 +XdrDetectionSummaryEvent = true
129 +IdpDetectionSummaryEvent = true
130 +
131 +# ----------------------------------------------------------------------------------------------------------------
132 +# Below configurations only applies if syslog is ENABLED (under Syslog: enabled=true
133 +# ----------------------------------------------------------------------------------------------------------------
134 +
135 +[EventSubTypeCollection]
136 +# Format: <EvenType>_<EventSubType> = true/false
137 +DetectionSummaryEvent_DnsRequests = true
138 +DetectionSummaryEvent_NetworkAccesses = true
139 +DetectionSummaryEvent_DocumentsAccessed = true
140 +DetectionSummaryEvent_ScanResults = true
141 +DetectionSummaryEvent_ExecutablesWritten = true
142 +DetectionSummaryEvent_QuarantineFiles = true
143 +HashSpreadingEvent_Sensors = true
144 +RemoteResponseSessionEndEvent_Commands = true
145 +MobileDetectionSummaryEvent_MobileAppsDetails = true
146 +MobileDetectionSummaryEvent_MobileNetworkConnections = true
147 +MobileDetectionSummaryEvent_MobileDnsRequests = true
148 +MobileDetectionSummaryEvent_MountedVolumes = true
149 +MobileDetectionSummaryEvent_Trampolines = true
150 +MobileDetectionSummaryEvent_LoadedObjects = true
151 +MobileDetectionSummaryEvent_ObjectiveCRuntimesAltered = true
152 +MobileDetectionSummaryEvent_RootAccessIndicators = true
153 +MobileDetectionSummaryEvent_Certificates = true
154 +MobileDetectionSummaryEvent_EnvironmentVariables = true
155 +MobileDetectionSummaryEvent_SystemProperties = true
156 +
157 +
158 +# FIELD MAPPINGS
159 +# Section name format: <EventType> OR <EventType>_<EventSubType>
160 +# Reserved keys:
161 +# __header.{n} where n is integer starting with 0
162 +#
163 +# There are 2 possible values for the mapping
164 +# 1. Literals which will be used as-is (for labelling) should be enclosed by single quotes
165 +# 2. Value based on incoming event
166 +#
167 +# If field mapping is not specified, then field will not appear in the results
168 +# DetectName has been deprecated because CrowdStrike now supports MITRE framework
169 +
170 +[DetectionSummaryEvent]
171 +__header.0 = metadata.eventType
172 +__header.1 = metadata.eventType
173 +__header.2 = event.Severity
174 +
175 +cat = event.Tactic
176 +externalId = event.SensorId
177 +cn2Label = 'ProcessId'
178 +cn2 = event.ProcessId
179 +cn1Label = 'ParentProcessId'
180 +cn1 = event.ParentProcessId
181 +dhost = event.ComputerName
182 +duser = event.UserName
183 +msg = event.DetectDescription
184 +fname = event.FileName
185 +filePath = event.FilePath
186 +cs5Label = 'CommandLine'
187 +cs5 = event.CommandLine
188 +fileHash = event.MD5String
189 +dntdom = event.MachineDomain
190 +cs6Label = 'FalconHostLink'
191 +cs6 = event.FalconHostLink
192 +cn3Label = 'Offset'
193 +cn3 = metadata.offset
194 +rt = metadata.eventCreationTime
195 +tactic = event.Tactic
196 +technique = event.Technique
197 +objective = event.Objective
198 +patternDisposition = event.PatternDispositionDescription
199 +outcome = event.PatternDispositionValue
200 +
201 +
202 +[DetectionSummaryEvent_DnsRequests]
203 +__header.0 = 'DNS Request In A Detection Summary Event'
204 +__header.1 = 'DNS Request In A Detection Summary Event'
205 +__header.2 = event.Severity
206 +
207 +cat = event.Tactic
208 +externalId = event.SensorId
209 +cn2Label = 'ProcessId'
210 +cn2 = event.ProcessId
211 +dhost = event.ComputerName
212 +duser = event.UserName
213 +fname = event.FileName
214 +filePath = event.FilePath
215 +dntdom = event.MachineDomain
216 +cs5Label = 'CommandLine'
217 +cs5 = event.CommandLine
218 +cs6Label = 'FalconHostLink'
219 +cs6 = event.FalconHostLink
220 +cn3Label = 'Offset'
221 +cn3 = metadata.offset
222 +deviceCustomDate1Label = 'DNS Request Time'
223 +deviceCustomDate1 = event.DnsRequests.LoadTime
224 +rt = metadata.eventCreationTime
225 +tactic = event.Tactic
226 +technique = event.Technique
227 +objective = event.Objective
228 +patternDisposition = event.PatternDispositionDescription
229 +outcome = event.PatternDispositionValue
230 +
231 +
232 +[DetectionSummaryEvent_NetworkAccesses]
233 +__header.0 = 'Network Access In A Detection Summary Event'
234 +__header.1 = 'Network Access In A Detection Summary Event'
235 +__header.2 = event.Severity
236 +
237 +cat = event.Tactic
238 +externalId = event.SensorId
239 +cn2Label = 'ProcessId'
240 +cn2 = event.ProcessId
241 +dhost = event.ComputerName
242 +duser = event.UserName
243 +fname = event.FileName
244 +filePath = event.FilePath
245 +cs5Label = 'CommandLine'
246 +cs5 = event.CommandLine
247 +dntdom = event.MachineDomain
248 +src = event.NetworkAccesses.LocalAddress
249 +c6a2 = event.NetworkAccesses.LocalAddress
250 +dst = event.NetworkAccesses.RemoteAddress
251 +c6a3 = event.NetworkAccesses.RemoteAddress
252 +spt = event.NetworkAccesses.LocalPort
253 +dpt = event.NetworkAccesses.RemotePort
254 +cs6Label = 'FalconHostLink'
255 +cs6 = event.FalconHostLink
256 +cn3Label = 'Offset'
257 +cn3 = metadata.offset
258 +deviceCustomDate1Label = 'Network Access Timestamp'
259 +deviceCustomDate1 = event.NetworkAccesses.AccessTimestamp
260 +rt = metadata.eventCreationTime
261 +tactic = event.Tactic
262 +technique = event.Technique
263 +objective = event.Objective
264 +patternDisposition = event.PatternDispositionDescription
265 +outcome = event.PatternDispositionValue
266 +
267 +
268 +[DetectionSummaryEvent_DocumentsAccessed]
269 +__header.0 = 'Document Access In A Detection Summary Event'
270 +__header.1 = 'Document Access In A Detection Summary Event'
271 +__header.2 = event.Severity
272 +
273 +cat = event.Tactic
274 +externalId = event.SensorId
275 +cn2Label = 'ProcessId'
276 +cn2 = event.ProcessId
277 +dhost = event.ComputerName
278 +duser = event.UserName
279 +fname = event.FileName
280 +filePath = event.FilePath
281 +dntdom = event.MachineDomain
282 +cs2Label = 'AccessedDocFileName'
283 +cs2 = event.DocumentsAccessed.FileName
284 +cs3Label = 'AccessedDocFilePath'
285 +cs3 = event.DocumentsAccessed.FilePath
286 +cs5Label = 'CommandLine'
287 +cs5 = event.CommandLine
288 +cs6Label = 'FalconHostLink'
289 +cs6 = event.FalconHostLink
290 +cn3Label = 'Offset'
291 +cn3 = metadata.offset
292 +deviceCustomDate1Label = 'Document Accessed Timestamp'
293 +deviceCustomDate1 = event.DocumentsAccessed.Timestamp
294 +rt = metadata.eventCreationTime
295 +tactic = event.Tactic
296 +technique = event.Technique
297 +objective = event.Objective
298 +patternDisposition = event.PatternDispositionDescription
299 +outcome = event.PatternDispositionValue
300 +
301 +[DetectionSummaryEvent_ScanResults]
302 +__header.0 = 'AV Scan Results In A Detection Summary Event'
303 +__header.1 = 'AV Scan Results In A Detection Summary Event'
304 +__header.2 = event.Severity
305 +
306 +cat = event.Tactic
307 +externalId = event.SensorId
308 +cn2Label = 'ProcessId'
309 +cn2 = event.ProcessId
310 +dhost = event.ComputerName
311 +duser = event.UserName
312 +fname = event.FileName
313 +filePath = event.FilePath
314 +fileHash = event.MD5String
315 +dntdom = event.MachineDomain
316 +cs2Label = 'ScanResultEngine'
317 +cs2 = event.ScanResults.Engine
318 +cs1Label = 'ScanResultName'
319 +cs1 = event.ScanResults.ResultName
320 +cs4Label = 'ScanResultVersion'
321 +cs4 = event.ScanResults.Version
322 +cs5Label = 'CommandLine'
323 +cs5 = event.CommandLine
324 +cs6Label = 'FalconHostLink'
325 +cs6 = event.FalconHostLink
326 +cn3Label = 'Offset'
327 +cn3 = metadata.offset
328 +rt = metadata.eventCreationTime
329 +tactic = event.Tactic
330 +technique = event.Technique
331 +objective = event.Objective
332 +patternDisposition = event.PatternDispositionDescription
333 +outcome = event.PatternDispositionValue
334 +
335 +[DetectionSummaryEvent_ExecutablesWritten]
336 +__header.0 = 'Executable Written In A Detection Summary Event'
337 +__header.1 = 'Executable Written In A Detection Summary Event'
338 +__header.2 = event.Severity
339 +
340 +cat = event.Tactic
341 +externalId = event.SensorId
342 +cn2Label = 'ProcessId'
343 +cn2 = event.ProcessId
344 +dhost = event.ComputerName
345 +duser = event.UserName
346 +fname = event.FileName
347 +filePath = event.FilePath
348 +dntdom = event.MachineDomain
349 +cs2Label = 'WrittenExeFileName'
350 +cs2 = event.ExecutablesWritten.FileName
351 +cs3Label = 'WrittenExeFilePath'
352 +cs3 = event.ExecutablesWritten.FilePath
353 +cs5Label = 'CommandLine'
354 +cs5 = event.CommandLine
355 +cs6Label = 'FalconHostLink'
356 +cs6 = event.FalconHostLink
357 +cn3Label = 'Offset'
358 +cn3 = metadata.offset
359 +deviceCustomDate1Label = 'ExeWrittenTimestamp'
360 +deviceCustomDate1 = event.ExecutablesWritten.Timestamp
361 +rt = metadata.eventCreationTime
362 +tactic = event.Tactic
363 +technique = event.Technique
364 +objective = event.Objective
365 +patternDisposition = event.PatternDispositionDescription
366 +outcome = event.PatternDispositionValue
367 +
368 +[DetectionSummaryEvent_QuarantineFiles]
369 +__header.0 = 'Quarantined Files In A Detection Summary Event'
370 +__header.1 = 'Quarantined Files In A Detection Summary Event'
371 +__header.2 = event.Severity
372 +
373 +cat = event.Tactic
374 +externalId = event.SensorId
375 +cn2Label = 'ProcessId'
376 +cn2 = event.ProcessId
377 +dhost = event.ComputerName
378 +duser = event.UserName
379 +fname = event.FileName
380 +filePath = event.FilePath
381 +dntdom = event.MachineDomain
382 +cs2Label = 'QuarantineFileSHA256'
383 +cs2 = event.QuarantineFiles.SHA256HashData
384 +cs3Label = 'QuarantineFilePath'
385 +cs3 = event.QuarantineFiles.ImageFileName
386 +cs5Label = 'CommandLine'
387 +cs5 = event.CommandLine
388 +cs6Label = 'FalconHostLink'
389 +cs6 = event.FalconHostLink
390 +cn3Label = 'Offset'
391 +cn3 = metadata.offset
392 +deviceCustomDate1Label = 'ExeWrittenTimestamp'
393 +deviceCustomDate1 = event.ExecutablesWritten.Timestamp
394 +rt = metadata.eventCreationTime
395 +tactic = event.Tactic
396 +technique = event.Technique
397 +objective = event.Objective
398 +patternDisposition = event.PatternDispositionDescription
399 +outcome = event.PatternDispositionValue
400 +
401 +[UserActivityAuditEvent]
402 +__header.0 = metadata.eventType
403 +__header.1 = event.OperationName
404 +__header.2 = '1'
405 +
406 +cat = metadata.eventType
407 +destinationTranslatedAddress = event.UserIp
408 +duser = event.UserId
409 +deviceProcessName = event.ServiceName
410 +cn3Label = 'Offset'
411 +cn3 = metadata.offset
412 +outcome = event.Success
413 +rt = metadata.eventCreationTime
414 +
415 +[AuthActivityAuditEvent]
416 +__header.0 = event.OperationName
417 +__header.1 = event.OperationName
418 +__header.2 = '1'
419 +
420 +cat = metadata.eventType
421 +destinationTranslatedAddress = event.UserIp
422 +duser = event.UserId
423 +deviceProcessName = event.ServiceName
424 +cn3Label = 'Offset'
425 +cn3 = metadata.offset
426 +outcome = event.Success
427 +deviceCustomDate1Label = 'Timestamp'
428 +deviceCustomDate1 = event.UTCTimestamp
429 +rt = metadata.eventCreationTime
430 +
431 +[HashSpreadingEvent]
432 +__header.0 = 'Hash Spreading Summary'
433 +__header.1 = 'Hash Spreading Event-Summary'
434 +__header.2 = '5'
435 +
436 +cat = event.ExecutionType
437 +deviceCustomDate1Label = 'DocAccessTimestamp'
438 +deviceCustomDate1 = event.AlertTime
439 +fname=event.FileName
440 +fileHash=event.SHA256String
441 +deviceCustomDate2Label = 'HashSpreadingEventTime'
442 +deviceCustomDate2 = metadata.eventCreationTime
443 +
444 +[HashSpreadingEvent_Sensors]
445 +__header.0 = 'Hash Spreading Sensor'
446 +__header.1 = 'Hash Spreading Event-Sensor Details'
447 +__header.2 = '5'
448 +
449 +cat = event.ExecutionType
450 +deviceCustomDate1Label = 'DocAccessTimestamp'
451 +deviceCustomDate1 = event.AlertTime
452 +fname = event.Sensors.Filename
453 +fileHash=event.SHA256String
454 +dhost = event.Sensors.HostnameField
455 +deviceCustomDate2Label = 'HashSpreadingSensorEventTime'
456 +deviceCustomDate2 = event.Sensors.LastWriteTime
457 +
458 +[RemoteResponseSessionStartEvent]
459 +__header.0 = metadata.eventType
460 +__header.1 = 'Remote Response Session Start event'
461 +__header.2 = '1'
462 +
463 +cat = metadata.eventType
464 +cn3Label = 'Offset'
465 +cn3 = metadata.offset
466 +rt = metadata.eventCreationTime
467 +dhost = event.HostnameField
468 +duser = event.UserName
469 +sessionStartTimestampLabel = 'RemoteResponseSessionStartTimestamp'
470 +sessionStartTimestamp = event.StartTimestamp
471 +
472 +[RemoteResponseSessionEndEvent]
473 +__header.0 = metadata.eventType
474 +__header.1 = 'Remote Response Session End event'
475 +__header.2 = '1'
476 +
477 +cat = metadata.eventType
478 +cn3Label = 'Offset'
479 +cn3 = metadata.offset
480 +rt = metadata.eventCreationTime
481 +dhost = event.HostnameField
482 +duser = event.UserName
483 +sessionEndTimestampLabel = 'RemoteResponseSessionEndTimestamp'
484 +sessionEndTimestamp = event.EndTimestamp
485 +
486 +[RemoteResponseSessionEndEvent_Commands]
487 +__header.0 = metadata.eventType
488 +__header.1 = 'Remote Response Session End event'
489 +__header.2 = '1'
490 +
491 +cat = metadata.eventType
492 +cn3Label = 'Offset'
493 +cn3 = metadata.offset
494 +rt = metadata.eventCreationTime
495 +dhost = event.HostnameField
496 +duser = event.UserName
497 +sessionEndTimestampLabel = 'RemoteResponseSessionEndTimestamp'
498 +sessionEndTimestamp = event.EndTimestamp
499 +cmdLabel = 'Command'
500 +cmd = event.Commands
501 +
502 +
503 +[FirewallMatchEvent]
504 +__header.0 = metadata.eventType
505 +__header.1 = 'Firewall Match event'
506 +__header.2 = '1'
507 +
508 +cat = metadata.eventType
509 +deviceId = event.DeviceId
510 +ipVLabel = 'IpV'
511 +ipV = event.IpV
512 +cmdLineLabel = 'Command Line'
513 +cmdLine = event.CommandLine
514 +connectionDirectionLabel = 'Connection Direction'
515 +connectionDirection = event.ConnectionDirection
516 +eventType = event.EventType
517 +flags = event.Flags
518 +hostName = event.HostName
519 +icmpCodeLabel = 'ICMP Code'
520 +icmpCode = event.ICMPCode
521 +icmpTypeLabel = 'ICMP Type'
522 +icmpType = event.ICMPType
523 +imageFileNameLabel = 'Image File Name'
524 +imageFileName = event.ImageFileName
525 +localAddressLabel = 'Local Address'
526 +localAddress = event.LocalAddress
527 +localPortLabel = 'Local Port'
528 +localPort = event.LocalPort
529 +matchCountLabel = 'Match Count'
530 +matchCount = event.MatchCount
531 +matchCountSinceLastReportLabel = 'Match Count Since Last Report'
532 +matchCount = event.MatchCountSinceLastReport
533 +networkProfileLabel = 'Network Profile'
534 +networkProfile = event.NetworkProfile
535 +PolicyNameLabel = 'Policy Name'
536 +networkProfile = event.PolicyName
537 +protocolLabel = 'Protocol'
538 +protocol = event.Protocol
539 +remoteAddressLabel = 'Remote Address'
540 +remoteAddress = event.RemoteAddress
541 +remotePortLabel = 'Remote Port'
542 +remotePort = event.RemotePort
543 +ruleActionLabel = 'Rule Action'
544 +ruleAction = event.RuleAction
545 +ruleDescriptionLabel = 'Rule Description'
546 +ruleDescription = event.RuleDescription
547 +ruleGroupNameLabel = 'Rule Group Name'
548 +ruleGroupName = event.RuleGroupName
549 +ruleNameLabel = 'Rule Name'
550 +ruleName = event.RuleName
551 +statusLabel = 'Status'
552 +status = event.Status
553 +cn3Label = 'Offset'
554 +cn3 = metadata.offset
555 +rt = metadata.eventCreationTime
556 +
557 +
558 +[CSPMSearchStreamingEvent]
559 +__header.0 = metadata.eventType
560 +__header.1 = 'CSPM Search Streaming event'
561 +__header.2 = '1'
562 +
563 +cat = metadata.eventType
564 +accountIdLabel = 'AccountId'
565 +accountId = event.AccountId
566 +regionLabel = 'Region'
567 +region = event.Region
568 +resourceIdLabel = 'ResourceId'
569 +resourceId = event.ResourceId
570 +resourceIdTypeLabel = 'ResourceIdType'
571 +resourceIdType = event.ResourceIdType
572 +resourceNameLabel = 'ResourceName'
573 +resourceName = event.ResourceName
574 +resourceCreateTimeLabel = 'ResourceCreateTime'
575 +resourceCreateTime = event.ResourceCreateTime
576 +policyStatementLabel = 'PolicyStatement'
577 +policyStatement = event.PolicyStatement
578 +severityNameLabel = 'SeverityName'
579 +severityName = event.SeverityName
580 +cloudPlatformLabel = 'CloudPlatform'
581 +cloudPlatform = event.CloudPlatform
582 +cloudServiceLabel = 'CloudService'
583 +cloudService = event.CloudService
584 +dispositionLabel = 'Disposition'
585 +disposition = event.Disposition
586 +resourceUrlLabel = 'ResourceUrl'
587 +resourceUrl = event.ResourceUrl
588 +findingLabel = 'Finding'
589 +finding = event.Finding
590 +resourceAttributesLabel = 'ResourceAttributes'
591 +resourceAttributes = event.ResourceAttributes
592 +tagsLabel = 'Tags'
593 +tags = event.Tags
594 +timestampLabel = 'Timestamp'
595 +timestamp = event.Timestamp
596 +
597 +[CSPMIOAStreamingEvent]
598 +__header.0 = metadata.eventType
599 +__header.1 = 'CSPM IOA Streaming event'
600 +__header.2 = '1'
601 +
602 +cat = metadata.eventType
603 +accountIdLabel = 'AccountId'
604 +accountId = event.AccountId
605 +policyStatementLabel = 'PolicyStatement'
606 +policyStatement = event.PolicyStatement
607 +cloudProviderLabel = 'CloudProvider'
608 +cloudProvider = event.CloudProvider
609 +cloudServiceLabel = 'CloudService'
610 +cloudService = event.CloudService
611 +severityNameLabel = 'SeverityName'
612 +severityName = event.SeverityName
613 +eventActionLabel = 'EventAction'
614 +eventAction = event.EventAction
615 +eventSourceLabel = 'EventSource'
616 +eventSource = event.EventSource
617 +eventCreatedTimeLabel = 'EventCreatedTimestamp'
618 +eventCreatedTime = event.EventCreatedTimestamp
619 +userIdLabel = 'UserId'
620 +userId = event.UserId
621 +userNameLabel = 'UserName'
622 +userName = event.UserName
623 +userSourceIpLabel = 'UserSourceIp'
624 +userSourceIp = event.UserSourceIp
625 +tacticLabel = 'Tactic'
626 +tactic = event.Tactic
627 +techniqueLabel = 'Technique'
628 +technique = event.Technique
629 +
630 +[CustomerIOCEvent]
631 +__header.0 = 'Indicator of Compromise'
632 +cat = metadata.eventType
633 +devTimeFormat='yyyy-MM-dd HH:mm:ss'
634 +devTime = metadata.eventCreationTime
635 +commandLine = event.CommandLine
636 +resource = event.ComputerName
637 +fileName = event.FileName
638 +filePath = event.FilePath
639 +dnsRequestDomain = event.DomainName
640 +dstIPv4 = event.IPv4
641 +dstIPv6 = event.IPv6
642 +md5 = event.MD5String
643 +sha1 = event.SHA1String
644 +sha256 = event.SHA256String
645 +
646 +[IncidentSummaryEvent]
647 +__header.0 = metadata.eventType
648 +__header.1 = metadata.eventType
649 +__header.2 = '5'
650 +cat = metadata.eventType
651 +cs1Label = 'FalconHostLink'
652 +cs1 = event.FalconHostLink
653 +cs2Label = 'State'
654 +cs2 = event.State
655 +cn3Label = 'FineScore'
656 +cn3 = event.FineScore
657 +deviceCustomDate1Label = 'IncidentStartTime'
658 +deviceCustomDate1 = event.IncidentStartTime
659 +deviceCustomDate2Label = 'IncidentEndTime'
660 +deviceCustomDate2 = event.IncidentEndTime
661 +deviceCustomDate2 = event.IncidentEndTime
662 +
663 +[IdentityProtectionEvent]
664 +__header.0 = event.Category
665 +__header.1 = event.Severity
666 +
667 +cat = event.Category
668 +cs1Label = 'incidentType'
669 +cs1 = event.IncidentType
670 +severityNameLabel = 'severityName'
671 +severityName = event.SeverityName
672 +msg = event.IncidentDescription
673 +deviceCustomDate1Label = 'startTime'
674 +deviceCustomDate1 = event.StartTime
675 +deviceCustomDate2Label = 'endTime'
676 +deviceCustomDate2 = event.EndTime
677 +cs2Label = 'identityProtectionIncidentId'
678 +cs2 = event.IdentityProtectionIncidentId
679 +duser = event.UserName
680 +dhost = event.EndpointName
681 +cs3Label = 'endpointIp'
682 +cs3 = event.EndpointIp
683 +cn1Label = 'numberOfCompromisedEntities'
684 +cn1 = event.NumberOfCompromisedEntities
685 +cn2Label = 'numbersOfAlerts'
686 +cn2 = event.NumbersOfAlerts
687 +cs4Label = 'falconHostLink'
688 +cs4 = event.FalconHostLink
689 +stateLabel = 'state'
690 +state = event.State
691 +
692 +[ReconNotificationSummaryEvent]
693 +__header.0 = metadata.eventType
694 +__header.1 = 'Recon Notification Summary Event'
695 +__header.2 = '1'
696 +
697 +cat = metadata.eventType
698 +notificationIdLabel = 'NotificationId'
699 +notificationId = event.NotificationId
700 +highlightsLabel = 'MatchHighlights'
701 +highlights = event.Highlights
702 +matchedTimestampLabel = 'MatchTimestamp'
703 +matchedTimestamp = event.MatchedTimestamp
704 +ruleIdLabel = 'MonitoringRuleId'
705 +ruleId = event.RuleId
706 +ruleNameLabel = 'MonitoringRuleName'
707 +ruleName = event.RuleName
708 +ruleTopicLabel = 'MonitoringRuleTopic'
709 +ruleTopic = event.RuleTopic
710 +rulePriorityLabel = 'MonitoringRulePriority'
711 +rulePriority = event.RulePriority
712 +itemIdLabel = 'RawIntelligenceItemId'
713 +itemId = event.ItemId
714 +itemTypeLabel = 'RawIntelligenceItemType'
715 +itemType = event.ItemType
716 +itemPostedTimestampLabel = 'RawIntelligenceItemPostedTimestamp'
717 +itemPostedTimestamp = event.ItemPostedTimestamp
718 +
719 +[ScheduledReportNotificationEvent]
720 +__header.0 = metadata.eventType
721 +__header.1 = 'Scheduled Report Notification Event'
722 +__header.2 = '1'
723 +
724 +cat = metadata.eventType
725 +userUUIDLabel = 'UserUUID'
726 +userUUID = event.UserUUID
727 +userIDLabel = 'UserID'
728 +userID = event.UserID
729 +executionIDLabel = 'ExecutionID'
730 +executionID = event.ExecutionID
731 +reportIDLabel = 'ReportID'
732 +reportID = event.ReportID
733 +reportNameLabel = 'ReportName'
734 +reportName = event.ReportName
735 +reportTypeLabel = 'ReportType'
736 +reportType = event.ReportType
737 +reportFileReferenceLabel = 'ReportFileReference'
738 +reportFileReference = event.ReportFileReference
739 +statusLabel = 'Status'
740 +status = event.Status
741 +statusMessageLabel = 'StatusMessage'
742 +statusMessage = event.StatusMessage
743 +executionMetadataLabel = 'ExecutionMetadata'
744 +executionMetadata = event.ExecutionMetadata
745 +
746 +[MobileDetectionSummaryEvent]
747 +__header.0 = metadata.eventType
748 +__header.1 = metadata.eventType
749 +__header.2 = event.Severity
750 +
751 +cat = event.Tactic
752 +externalId = event.SensorId
753 +dhost = event.ComputerName
754 +duser = event.UserName
755 +msg = event.DetectDescription
756 +dvcpid = event.ProcessId
757 +cn1Label = 'SELinuxEnforcementPolicy'
758 +cn1 = event.SELinuxEnforcementPolicy
759 +cs6Label = 'FalconHostLink'
760 +cs6 = event.FalconHostLink
761 +cn3Label = 'Offset'
762 +cn3 = metadata.offset
763 +deviceCustomDate1Label = 'ContextTimeStamp'
764 +deviceCustomDate1 = event.ContextTimeStamp
765 +rt = metadata.eventCreationTime
766 +tactic = event.Tactic
767 +technique = event.Technique
768 +objective = event.Objective
769 +
770 +[MobileDetectionSummaryEvent_MobileAppsDetails]
771 +__header.0 = 'Mobile Application Details In A Mobile Detection Summary Event'
772 +__header.1 = 'Mobile Application Details In A Mobile Detection Summary Event'
773 +__header.2 = event.Severity
774 +
775 +cat = event.Tactic
776 +externalId = event.SensorId
777 +dhost = event.ComputerName
778 +duser = event.UserName
779 +msg = event.DetectDescription
780 +dvcpid = event.ProcessId
781 +cs1Label = 'AppIdentifier'
782 +cs1 = event.MobileAppsDetails.AppIdentifier
783 +cs2Label = 'AppInstallerInformation'
784 +cs2 = event.MobileAppsDetails.AppInstallerInformation
785 +fname = event.MobileAppsDetails.ImageFileName
786 +fileHash = event.MobileAppsDetails.SHA256HashData
787 +cs3Label = 'DexFileHashes'
788 +cs3 = event.MobileAppsDetails.DexFileHashes
789 +cs4Label = 'AndroidAppVersionName'
790 +cs4 = event.MobileAppsDetails.AndroidAppVersionName
791 +cn1Label = 'HarmfulAppCategory'
792 +cn1 = event.MobileAppsDetails.HarmfulAppCategory
793 +cs5Label = 'AndroidComponentName'
794 +cs5 = event.MobileAppsDetails.AndroidComponentName
795 +cs6Label = 'FalconHostLink'
796 +cs6 = event.FalconHostLink
797 +cn3Label = 'Offset'
798 +cn3 = metadata.offset
799 +deviceCustomDate1Label = 'ContextTimeStamp'
800 +deviceCustomDate1 = event.ContextTimeStamp
801 +rt = metadata.eventCreationTime
802 +tactic = event.Tactic
803 +technique = event.Technique
804 +objective = event.Objective
805 +
806 +[MobileDetectionSummaryEvent_MobileNetworkConnections]
807 +__header.0 = 'Network Connection In A Mobile Detection Summary Event'
808 +__header.1 = 'Network Connection In A Mobile Detection Summary Event'
809 +__header.2 = event.Severity
810 +
811 +cat = event.Tactic
812 +externalId = event.SensorId
813 +dhost = event.ComputerName
814 +duser = event.UserName
815 +msg = event.DetectDescription
816 +dvcpid = event.ProcessId
817 +cs1Label = 'Protocol'
818 +cs1 = event.MobileNetworkConnections.Protocol
819 +cn1Label = 'ConnectionFlags'
820 +cn1 = event.MobileNetworkConnections.ConnectionFlags
821 +src = event.MobileNetworkConnections.LocalAddress
822 +c6a2 = event.MobileNetworkConnections.LocalAddress
823 +dst = event.MobileNetworkConnections.RemoteAddress
824 +c6a3 = event.MobileNetworkConnections.RemoteAddress
825 +spt = event.MobileNetworkConnections.LocalPort
826 +dpt = event.MobileNetworkConnections.RemotePort
827 +deviceDirection = MobileNetworkConnections.ConnectionDirection
828 +request = event.MobileNetworkConnections.Url
829 +cs2Label = 'AppIdentifier'
830 +cs2 = event.MobileNetworkConnections.AppIdentifier
831 +cs3Label = 'IsAndroidAppContainerized'
832 +cs3 = event.MobileNetworkConnections.IsAndroidAppContainerized
833 +cn2Label = 'ContextProcessId'
834 +cn2 = event.MobileNetworkConnections.ContextProcessId
835 +cs6Label = 'FalconHostLink'
836 +cs6 = event.FalconHostLink
837 +cn3Label = 'Offset'
838 +cn3 = metadata.offset
839 +deviceCustomDate1Label = 'Network Connection Timestamp'
840 +deviceCustomDate1 = event.MobileNetworkConnections.AccessTimestamp
841 +rt = metadata.eventCreationTime
842 +tactic = event.Tactic
843 +technique = event.Technique
844 +objective = event.Objective
845 +
846 +[MobileDetectionSummaryEvent_MobileDnsRequests]
847 +__header.0 = 'Dns Request In A Mobile Detection Summary Event'
848 +__header.1 = 'Dns Request In A Mobile Detection Summary Event'
849 +__header.2 = event.Severity
850 +
851 +cat = event.Tactic
852 +externalId = event.SensorId
853 +dhost = event.ComputerName
854 +duser = event.UserName
855 +msg = event.DetectDescription
856 +dvcpid = event.ProcessId
857 +destinationDnsDomain = event.MobileDnsRequests.DomainName
858 +cs1Label = 'RequestType'
859 +cs1 = event.MobileDnsRequests.RequestType
860 +cs2Label = 'AppIdentifier'
861 +cs2 = event.MobileDnsRequests.AppIdentifier
862 +dst = event.MobileDnsRequests.IpAddress
863 +c6a3 = event.MobileDnsRequests.IpAddress
864 +cn1Label = 'ContextProcessId'
865 +cn1 = event.MobileDnsRequests.ContextProcessId
866 +cs6Label = 'FalconHostLink'
867 +cs6 = event.FalconHostLink
868 +cn3Label = 'Offset'
869 +cn3 = metadata.offset
870 +deviceCustomDate1Label = 'DNS Request Timestamp'
871 +deviceCustomDate1 = event.MobileDnsRequests.AccessTimestamp
872 +rt = metadata.eventCreationTime
873 +tactic = event.Tactic
874 +technique = event.Technique
875 +objective = event.Objective
876 +
877 +[MobileDetectionSummaryEvent_MountedVolumes]
878 +__header.0 = 'Mounted Volume In A Mobile Detection Summary Event'
879 +__header.1 = 'Mounted Volume In A Mobile Detection Summary Event'
880 +__header.2 = event.Severity
881 +
882 +cat = event.Tactic
883 +externalId = event.SensorId
884 +dhost = event.ComputerName
885 +duser = event.UserName
886 +msg = event.DetectDescription
887 +dvcpid = event.ProcessId
888 +cs1Label = 'Type'
889 +cs1 = event.MountedVolumes.Type
890 +cs2Label = 'MountPoint'
891 +cs2 = event.MountedVolumes.MountPoint
892 +cs3Label = 'MountFlags'
893 +cs3 = event.MountedVolumes.MountFlags
894 +cs4Label = 'RealDeviceName'
895 +cs4 = event.MountedVolumes.RealDeviceName
896 +cs6Label = 'FalconHostLink'
897 +cs6 = event.FalconHostLink
898 +cn3Label = 'Offset'
899 +cn3 = metadata.offset
900 +deviceCustomDate1Label = 'ContextTimeStamp'
901 +deviceCustomDate1 = event.ContextTimeStamp
902 +rt = metadata.eventCreationTime
903 +tactic = event.Tactic
904 +technique = event.Technique
905 +objective = event.Objective
906 +
907 +[MobileDetectionSummaryEvent_Trampolines]
908 +__header.0 = 'Trampoline In A Mobile Detection Summary Event'
909 +__header.1 = 'Trampoline In A Mobile Detection Summary Event'
910 +__header.2 = event.Severity
911 +
912 +cat = event.Tactic
913 +externalId = event.SensorId
914 +dhost = event.ComputerName
915 +duser = event.UserName
916 +msg = event.DetectDescription
917 +dvcpid = event.ProcessId
918 +cs1Label = 'FunctionName'
919 +cs1 = event.Trampolines.FunctionName
920 +cs2Label = 'ExecutableBytes'
921 +cs2 = event.Trampolines.ExecutableBytes
922 +fname = event.Trampolines.ImageFileName
923 +cs6Label = 'FalconHostLink'
924 +cs6 = event.FalconHostLink
925 +cn3Label = 'Offset'
926 +cn3 = metadata.offset
927 +deviceCustomDate1Label = 'ContextTimeStamp'
928 +deviceCustomDate1 = event.ContextTimeStamp
929 +rt = metadata.eventCreationTime
930 +tactic = event.Tactic
931 +technique = event.Technique
932 +objective = event.Objective
933 +
934 +[MobileDetectionSummaryEvent_LoadedObjects]
935 +__header.0 = 'Loaded Object In A Mobile Detection Summary Event'
936 +__header.1 = 'Loaded Object In A Mobile Detection Summary Event'
937 +__header.2 = event.Severity
938 +
939 +cat = event.Tactic
940 +externalId = event.SensorId
941 +dhost = event.ComputerName
942 +duser = event.UserName
943 +msg = event.DetectDescription
944 +dvcpid = event.ProcessId
945 +fname = event.LoadedObjects.FileName
946 +fileHash = event.LoadedObjects.SHA256HashData
947 +cs1Label = 'CodeSigningFlags'
948 +cs1 = event.LoadedObjects.CodeSigningFlags
949 +cs6Label = 'FalconHostLink'
950 +cs6 = event.FalconHostLink
951 +cn3Label = 'Offset'
952 +cn3 = metadata.offset
953 +deviceCustomDate1Label = 'ContextTimeStamp'
954 +deviceCustomDate1 = event.ContextTimeStamp
955 +rt = metadata.eventCreationTime
956 +tactic = event.Tactic
957 +technique = event.Technique
958 +objective = event.Objective
959 +
960 +[MobileDetectionSummaryEvent_ObjectiveCRuntimesAltered]
961 +__header.0 = 'ObjectiveC Runtime Altered In A Mobile Detection Summary Event'
962 +__header.1 = 'ObjectiveC Runtime Altered In A Mobile Detection Summary Event'
963 +__header.2 = event.Severity
964 +
965 +cat = event.Tactic
966 +externalId = event.SensorId
967 +dhost = event.ComputerName
968 +duser = event.UserName
969 +msg = event.DetectDescription
970 +dvcpid = event.ProcessId
971 +cs1Label = 'MethodSignature'
972 +cs1 = event.ObjectiveCRuntimesAltered.MethodSignature
973 +fname = event.ObjectiveCRuntimesAltered.ImageFileName
974 +cs2Label = 'ExpectedImageFileName'
975 +cs2 = event.ObjectiveCRuntimesAltered.ExpectedImageFileName
976 +cs3Label = 'SuspectAddress'
977 +cs3 = event.ObjectiveCRuntimesAltered.SuspectAddress
978 +cs4Label = 'ExpectedAddress'
979 +cs4 = event.ObjectiveCRuntimesAltered.ExpectedAddress
980 +cs6Label = 'FalconHostLink'
981 +cs6 = event.FalconHostLink
982 +cn3Label = 'Offset'
983 +cn3 = metadata.offset
984 +deviceCustomDate1Label = 'ContextTimeStamp'
985 +deviceCustomDate1 = event.ContextTimeStamp
986 +rt = metadata.eventCreationTime
987 +tactic = event.Tactic
988 +technique = event.Technique
989 +objective = event.Objective
990 +
991 +[MobileDetectionSummaryEvent_RootAccessIndicators]
992 +__header.0 = 'Root Access Indicators In A Mobile Detection Summary Event'
993 +__header.1 = 'Root Access Indicators In A Mobile Detection Summary Event'
994 +__header.2 = event.Severity
995 +
996 +cat = event.Tactic
997 +externalId = event.SensorId
998 +dhost = event.ComputerName
999 +duser = event.UserName
1000 +msg = event.DetectDescription
1001 +dvcpid = event.ProcessId
1002 +cs1Label = 'LogcatMessage'
1003 +cs1 = event.RootAccessIndicators.LogcatMessage
1004 +cs2Label = 'AndroidStackTrace'
1005 +cs2 = event.RootAccessIndicators.AndroidStackTrace
1006 +cs3Label = 'HookedFunctionName'
1007 +cs3 = event.RootAccessIndicators.HookedFunctionName
1008 +cs4Label = 'AndroidInitServiceName'
1009 +cs4 = event.RootAccessIndicators.AndroidInitServiceName
1010 +cs6Label = 'FalconHostLink'
1011 +cs6 = event.FalconHostLink
1012 +cn3Label = 'Offset'
1013 +cn3 = metadata.offset
1014 +deviceCustomDate1Label = 'ContextTimeStamp'
1015 +deviceCustomDate1 = event.ContextTimeStamp
1016 +rt = metadata.eventCreationTime
1017 +tactic = event.Tactic
1018 +technique = event.Technique
1019 +objective = event.Objective
1020 +
1021 +[MobileDetectionSummaryEvent_Certificates]
1022 +__header.0 = 'Certificate In A Mobile Detection Summary Event'
1023 +__header.1 = 'Certificate In A Mobile Detection Summary Event'
1024 +__header.2 = event.Severity
1025 +
1026 +cat = event.Tactic
1027 +externalId = event.SensorId
1028 +dhost = event.ComputerName
1029 +duser = event.UserName
1030 +msg = event.DetectDescription
1031 +dvcpid = event.ProcessId
1032 +cs1Label = 'CertificateName'
1033 +cs1 = event.Certificates.Name
1034 +cs2Label = 'CertificateIssuer'
1035 +cs2 = event.Certificates.Issuer
1036 +cs3Label = 'CertificateFingerPrint'
1037 +cs3 = event.Certificates.FingerPrint
1038 +cs6Label = 'FalconHostLink'
1039 +cs6 = event.FalconHostLink
1040 +cn3Label = 'Offset'
1041 +cn3 = metadata.offset
1042 +deviceCustomDate1Label = 'ContextTimeStamp'
1043 +deviceCustomDate1 = event.ContextTimeStamp
1044 +rt = metadata.eventCreationTime
1045 +tactic = event.Tactic
1046 +technique = event.Technique
1047 +objective = event.Objective
1048 +
1049 +[MobileDetectionSummaryEvent_EnvironmentVariables]
1050 +__header.0 = 'Environment Variable In A Mobile Detection Summary Event'
1051 +__header.1 = 'Environment Variable In A Mobile Detection Summary Event'
1052 +__header.2 = event.Severity
1053 +
1054 +cat = event.Tactic
1055 +externalId = event.SensorId
1056 +dhost = event.ComputerName
1057 +duser = event.UserName
1058 +msg = event.DetectDescription
1059 +dvcpid = event.ProcessId
1060 +cs1Label = 'EnvironmentVariableName'
1061 +cs1 = event.EnvironmentVariables.Name
1062 +cs2Label = 'EnvironmentVariableValue'
1063 +cs2 = event.EnvironmentVariables.Value
1064 +cs6Label = 'FalconHostLink'
1065 +cs6 = event.FalconHostLink
1066 +cn3Label = 'Offset'
1067 +cn3 = metadata.offset
1068 +deviceCustomDate1Label = 'ContextTimeStamp'
1069 +deviceCustomDate1 = event.ContextTimeStamp
1070 +rt = metadata.eventCreationTime
1071 +tactic = event.Tactic
1072 +technique = event.Technique
1073 +objective = event.Objective
1074 +
1075 +[MobileDetectionSummaryEvent_SystemProperties]
1076 +__header.0 = 'System Property In A Mobile Detection Summary Event'
1077 +__header.1 = 'System Property In A Mobile Detection Summary Event'
1078 +__header.2 = event.Severity
1079 +
1080 +cat = event.Tactic
1081 +externalId = event.SensorId
1082 +dhost = event.ComputerName
1083 +duser = event.UserName
1084 +msg = event.DetectDescription
1085 +dvcpid = event.ProcessId
1086 +cs1Label = 'SystemPropertyName'
1087 +cs1 = event.SystemProperties.Name
1088 +cs2Label = 'SystemPropertyValue'
1089 +cs2 = event.SystemProperties.Value
1090 +cs6Label = 'FalconHostLink'
1091 +cs6 = event.FalconHostLink
1092 +cn3Label = 'Offset'
1093 +cn3 = metadata.offset
1094 +deviceCustomDate1Label = 'ContextTimeStamp'
1095 +deviceCustomDate1 = event.ContextTimeStamp
1096 +rt = metadata.eventCreationTime
1097 +tactic = event.Tactic
1098 +technique = event.Technique
1099 +objective = event.Objective
1100 +
1101 +[XdrDetectionSummaryEvent]
1102 +__header.0 = metadata.eventType
1103 +__header.1 = 'XDR Detection Summary Event'
1104 +__header.2 = event.Severity
1105 +
1106 +cat = metadata.eventType
1107 +msg = event.Description
1108 +rt = metadata.eventCreationTime
1109 +tactics = event.Tactics
1110 +techniques = event.Techniques
1111 +xdrTypeLabel = 'XdrType'
1112 +xdrType = event.XdrType
1113 +authorLabel = 'Author'
1114 +author = event.Author
1115 +
1116 +scheduledSearchExecutionIdLabel = 'ScheduledSearchExecutionId'
1117 +scheduledSearchExecutionId = event.ScheduledSearchExecutionId
1118 +scheduledSearchIdLabel = 'ScheduledSearchId'
1119 +scheduledSearchId = event.ScheduledSearchId
1120 +scheduledSearchUserIdLabel = 'ScheduledSearchUserId'
1121 +scheduledSearchUserId = event.ScheduledSearchUserId
1122 +scheduledSearchUserUUIDLabel = 'ScheduledSearchUserUUID'
1123 +scheduledSearchUserUUID = event.ScheduledSearchUserUUID
1124 +
1125 +sourceProductsLabel = 'SourceProducts'
1126 +sourceProducts = event.SourceProducts
1127 +sourceVendorsLabel = 'SourceVendors'
1128 +sourceVendors = event.SourceVendors
1129 +dataDomainsLabel = 'DataDomains'
1130 +dataDomains = event.DataDomains
1131 +ipv4AddressesLabel = 'IPv4Addresses'
1132 +ipv4Addresses = event.IPv4Addresses
1133 +ipv6AddressesLabel = 'IPv6Addresses'
1134 +ipv6Addresses = event.IPv6Addresses
1135 +hostNamesLabel = 'HostNames'
1136 +hostNames = event.HostNames
1137 +domainNamesLabel = 'DomainNames'
1138 +domainNames = event.DomainNames
1139 +emailAddressesLabel = 'EmailAddresses'
1140 +emailAddresses = event.EmailAddresses
1141 +sha256HashesLabel = 'SHA256Hashes'
1142 +sha256Hashes = event.SHA256Hashes
1143 +md5HashesLabel = 'MD5Hashes'
1144 +md5Hashes = event.MD5Hashes
1145 +usersLabel = 'Users'
1146 +users = event.Users
1147 +
1148 +cn3Label = 'Offset'
1149 +cn3 = metadata.offset
1150 +
1151 +
1152 +
1153 +[IdpDetectionSummaryEvent]
1154 +__header.0 = metadata.eventType
1155 +__header.1 = 'Identity Protection Detection Summary Event'
1156 +__header.2 = event.Severity
1157 +
1158 +cat = metadata.eventType
1159 +msg = event.DetectDescription
1160 +rt = metadata.eventCreationTime
1161 +tactic = event.Tactic
1162 +technique = event.Technique
1163 +
1164 +targetServiceAccessIdentifierLabel = 'TargetServiceAccessIdentifier'
1165 +targetServiceAccessIdentifier = event.TargetServiceAccessIdentifier
1166 +targetEndpointSensorIdLabel = 'TargetEndpointSensorId'
1167 +targetEndpointSensorId = event.TargetEndpointSensorId
1168 +targetEndpointHostNameLabel = 'TargetEndpointHostName'
1169 +targetEndpointHostName = event.TargetEndpointHostName
1170 +targetEndpointAccountObjectSidLabel = 'TargetEndpointAccountObjectSid'
1171 +targetEndpointAccountObjectSid = event.TargetEndpointAccountObjectSid
1172 +targetEndpointAccountObjectGuidLabel = 'TargetEndpointAccountObjectGuid'
1173 +targetEndpointAccountObjectGuid = event.TargetEndpointAccountObjectGuid
1174 +targetAccountUpnLabel = 'TargetAccountUpn'
1175 +targetAccountUpn = event.TargetAccountUpn
1176 +targetAccountObjectSidLabel = 'TargetAccountObjectSid'
1177 +targetAccountObjectSid = event.TargetAccountObjectSid
1178 +targetAccountNameLabel = 'TargetAccountName'
1179 +targetAccountName = event.TargetAccountName
1180 +targetAccountDomainLabel = 'TargetAccountDomain'
1181 +targetAccountDomain = event.TargetAccountDomain
1182 +suspiciousMachineAccountAlterationTypeLabel = 'SuspiciousMachineAccountAlterationType'
1183 +suspiciousMachineAccountAlterationType = event.SuspiciousMachineAccountAlterationType
1184 +startTimeLabel = 'StartTime'
1185 +startTime = event.StartTime
1186 +ssoApplicationIdentifierLabel = 'SsoApplicationIdentifier'
1187 +ssoApplicationIdentifier = event.SsoApplicationIdentifier
1188 +sourceEndpointSensorIdLabel = 'SourceEndpointSensorId'
1189 +sourceEndpointSensorId = event.SourceEndpointSensorId
1190 +sourceEndpointIpReputationLabel = 'SourceEndpointIpReputation'
1191 +sourceEndpointIpReputation = event.SourceEndpointIpReputation
1192 +sourceEndpointIpAddressLabel = 'SourceEndpointIpAddress'
1193 +sourceEndpointIpAddress = event.SourceEndpointIpAddress
1194 +sourceEndpointHostNameLabel = 'SourceEndpointHostName'
1195 +sourceEndpointHostName = event.SourceEndpointHostName
1196 +sourceEndpointAccountObjectSidLabel = 'SourceEndpointAccountObjectGuid'
1197 +sourceEndpointAccountObjectSid = event.SourceEndpointAccountObjectGuid
1198 +sourceEndpointAccountObjectSidLabel = 'SourceEndpointAccountObjectSid'
1199 +sourceEndpointAccountObjectSid = event.SourceEndpointAccountObjectSid
1200 +sourceAccountUpnLabel = 'SourceAccountUpn'
1201 +sourceAccountUpn = event.SourceAccountUpn
1202 +sourceAccountObjectSidLabel = 'SourceAccountObjectSid'
1203 +sourceAccountObjectSid = event.SourceAccountObjectSid
1204 +sourceAccountNameLabel = 'SourceAccountName'
1205 +sourceAccountName = event.SourceAccountName
1206 +sourceAccountDomainLabel = 'SourceAccountDomain'
1207 +sourceAccountDomain = event.SourceAccountDomain
1208 +severityNameLabel = 'SeverityName'
1209 +severityName = event.SeverityName
1210 +rpcOpClassificationLabel = 'RpcOpClassification'
1211 +rpcOpClassification = event.RpcOpClassification
1212 +protocolAnomalyClassificationLabel = 'ProtocolAnomalyClassification'
1213 +protocolAnomalyClassification = event.ProtocolAnomalyClassification
1214 +previousPrivilegesLabel = 'PreviousPrivileges'
1215 +previousPrivileges = event.PreviousPrivileges
1216 +precedingActivityTimeStampLabel = 'PrecedingActivityTimeStamp'
1217 +precedingActivityTimeStamp = event.PrecedingActivityTimeStamp
1218 +patternIdLabel = 'PatternId'
1219 +patternId = event.PatternId
1220 +objectiveLabel = 'Objective'
1221 +objective = event.Objective
1222 +mostRecentActivityTimeStampLabel = 'MostRecentActivityTimeStamp'
1223 +mostRecentActivityTimeStamp = event.MostRecentActivityTimeStamp
1224 +locationCountryCodeLabel = 'LocationCountryCode'
1225 +locationCountryCode = event.LocationCountryCode
1226 +ldapSearchQueryAttackLabel = 'LdapSearchQueryAttack'
1227 +ldapSearchQueryAttack = event.LdapSearchQueryAttack
1228 +idpPolicyRuleTriggerLabel = 'IdpPolicyRuleTrigger'
1229 +idpPolicyRuleTrigger = event.IdpPolicyRuleTrigger
1230 +idpPolicyRuleNameLabel = 'IdpPolicyRuleName'
1231 +idpPolicyRuleName = event.IdpPolicyRuleName
1232 +idpPolicyRuleActionLabel = 'IdpPolicyRuleAction'
1233 +idpPolicyRuleAction = event.IdpPolicyRuleAction
1234 +falconHostLinkLabel = 'FalconHostLink'
1235 +falconHostLink = event.FalconHostLink
1236 +endTimeLabel = 'EndTime'
1237 +endTime = event.EndTime
1238 +detectNameLabel = 'DetectName'
1239 +detectName = event.DetectName
1240 +detectIdLabel = 'DetectId'
1241 +detectId = event.DetectId
1242 +contextTimeStampLabel = 'ContextTimeStamp'
1243 +contextTimeStamp = event.ContextTimeStamp
1244 +attemptOutcomeLabel = 'AttemptOutcome'
1245 +attemptOutcome = event.AttemptOutcome
1246 +anomalousTicketContentClassificationLabel = 'AnomalousTicketContentClassification'
1247 +anomalousTicketContentClassification = event.AnomalousTicketContentClassification
1248 +additionalSsoApplicationIdentifierLabel = 'AdditionalSsoApplicationIdentifier'
1249 +additionalSsoApplicationIdentifier = event.AdditionalSsoApplicationIdentifier
1250 +additionalLocationCountryCodeLabel = 'AdditionalLocationCountryCode'
1251 +additionalLocationCountryCode = event.AdditionalLocationCountryCode
1252 +additionalEndpointSensorIdLabel = 'AdditionalEndpointSensorId'
1253 +additionalEndpointSensorId = event.AdditionalEndpointSensorId
1254 +additionalEndpointIpAddressLabel = 'AdditionalEndpointIpAddress'
1255 +additionalEndpointIpAddress = event.AdditionalEndpointIpAddress
1256 +additionalEndpointHostNameLabel = 'AdditionalEndpointHostName'
1257 +additionalEndpointHostName = event.AdditionalEndpointHostName
1258 +additionalEndpointAccountObjectSidLabel = 'AdditionalEndpointAccountObjectSid'
1259 +additionalEndpointAccountObjectSid = event.AdditionalEndpointAccountObjectSid
1260 +additionalEndpointAccountObjectGuidLabel = 'AdditionalEndpointAccountObjectGuid'
1261 +additionalEndpointAccountObjectGuid = event.AdditionalEndpointAccountObjectGuid
1262 +additionalActivityIdLabel = 'AdditionalActivityId'
1263 +additionalActivityId = event.AdditionalActivityId
1264 +additionalAccountUpnLabel = 'AdditionalAccountUpn'
1265 +additionalAccountUpn = event.AdditionalAccountUpn
1266 +additionalAccountObjectSidLabel = 'AdditionalAccountObjectSid'
1267 +additionalAccountObjectSid = event.AdditionalAccountObjectSid
1268 +additionalAccountNameLabel = 'AdditionalAccountName'
1269 +additionalAccountName = event.AdditionalAccountName
1270 +additionalAccountDomainLabel = 'AdditionalAccountDomain'
1271 +additionalAccountDomain = event.AdditionalAccountDomain
1272 +addedPrivilegeLabel = 'AddedPrivilege'
1273 +addedPrivilege = event.AddedPrivilege
1274 +activityIdLabel = 'ActivityId'
1275 +activityId = event.ActivityId
1276 +accountCreationTimeStampLabel = 'AccountCreationTimeStamp'
1277 +accountCreationTimeStamp = event.AccountCreationTimeStamp
1278 +
1279 +cn3Label = 'Offset'
1280 +cn3 = metadata.offset
frontend/src/api/integrations.ts
+6
@@ -54,6 +54,12 @@ export default {
54 integration_name: integrationName
55 })
56 },
57 + crowdstrikeProvision(customerCode: string, integrationName: string) {
58 + return HttpClient.post<FlaskBaseResponse>(`/crowdstrike/provision`, {
59 + customer_code: customerCode,
60 + integration_name: integrationName
61 + })
62 + },
63 office365Provision(customerCode: string, integrationName: string) {
64 return HttpClient.post<FlaskBaseResponse>(`/office365/provision`, {
65 customer_code: customerCode,
frontend/src/components/customers/integrations/CustomerIntegrationActions.vue
+36 -1
@@ -24,6 +24,18 @@
24 Deploy
25 </n-button>
26
27 + <n-button
28 + v-if="isCrowdstrike && !integration.deployed"
29 + :loading="loadingCrowdstrikeProvision"
30 + @click="crowdstrikeProvision()"
31 + type="success"
32 + :size="size"
33 + secondary
34 + >
35 + <template #icon><Icon :name="DeployIcon"></Icon></template>
36 + Deploy
37 + </n-button>
38 +
39 <n-button
40 :size="size"
41 type="error"
@@ -69,13 +81,15 @@ const dialog = useDialog()
81 const message = useMessage()
82 const loadingOffice365Provision = ref(false)
83 const loadingMimecastProvision = ref(false)
84 +const loadingCrowdstrikeProvision = ref(false)
85 const loadingDelete = ref(false)
73 -const loading = computed(() => loadingMimecastProvision.value || loadingOffice365Provision.value || loadingDelete.value)
86 +const loading = computed(() => loadingMimecastProvision.value || loadingCrowdstrikeProvision.value || loadingOffice365Provision.value || loadingDelete.value)
87
88 const serviceName = computed(() => integration.integration_service_name)
89 const customerCode = computed(() => integration.customer_code)
90 const isOffice365 = computed(() => serviceName.value === "Office365")
91 const isMimecast = computed(() => serviceName.value === "Mimecast")
92 +const isCrowdstrike = computed(() => serviceName.value === "Crowdstrike")
93
94 watch(loading, val => {
95 if (val) {
@@ -127,6 +141,27 @@ function mimecastProvision() {
141 })
142 }
143
144 +function crowdstrikeProvision() {
145 + loadingCrowdstrikeProvision.value = true
146 +
147 + Api.integrations
148 + .crowdstrikeProvision(customerCode.value, serviceName.value)
149 + .then(res => {
150 + if (res.data.success) {
151 + emit("deployed")
152 + message.success(res.data?.message || "Customer integration successfully deployed.")
153 + } else {
154 + message.warning(res.data?.message || "An error occurred. Please try again later.")
155 + }
156 + })
157 + .catch(err => {
158 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
159 + })
160 + .finally(() => {
161 + loadingCrowdstrikeProvision.value = false
162 + })
163 +}
164 +
165 function handleDelete() {
166 dialog.warning({
167 title: "Confirm",