chore: update crowdstrike MD
Taylor committed
May 10, 2024 at 09:47 UTC
a2222d5cb4c0bca876a9d129c86e4efbbd8731f9
2 files changed
+24
-1
backend/app/integrations/markdown/crowdstrike.md
+24
-1
@@ -4,6 +4,8 @@
4
5
Before using the Falcon SIEM Connector, you’ll want to first define the API client and set its scope. Refer to this guide (https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/) to getting access to the CrowdStrike API for setting up a new API client key. For the new API client, make sure the scope includes read access for Event streams.
6
7
+### IMPORTANT: If you are in the Government cloud of Crowdstrike, you must open a support ticket with Crowdstrike so they can enable the Falcon SIEM Connector on their end.
8
+
9
10
11
<!-- Running the Crowdstrike-Connector Container -->
@@ -16,7 +18,7 @@ The configuration for our API creds and syslog forwarder settings are stored wit
18
[Settings]
19
version = 3
20
api_url = REPLACE_BASE_URL/sensors/entities/datafeed/v2
19
-request_token_url = https://api.crowdstrike.com/oauth2/token
21
+request_token_url = REPLACE_BASE_URL/oauth2/token
22
app_id = SIEM-Connector-v2.0.0
23
24
enable_correlation_id = false
@@ -79,3 +81,24 @@ host = REPLACE_SYSLOG_HOST
81
port = REPLACE_SYSLOG_PORT
82
protocol = tcp
83
```
84
+
85
+## Provisioning
86
+Once you have saved the Crowdstrike configuration for the customer, you are ready to deploy the integration. Navigate to the `Customers` tab and select the appropriate customer. The provisiong creates the necessary:
87
+
88
+* Graylog CEF Input
89
+* Graylog Stream
90
+* Graylog Index
91
+* Grafana Datasource
92
+* Grafana Dashboards
93
+* Crowdstrike Docker-Compose File
94
+
95
+## Deployment of Crowdstrike Container
96
+The Crowdstrike integration runs via a docker container. During provisioning, the following directory is created `/opt/CoPilot/data/data/CUSTOMER_NAME`. Within this directory will reside the `CUSTOMER_NAME_docker-compose.yml` and the `cs.falconhoseclient.cfg` files. These can be modified if desired but should already contain the details needed to collect logs for their Crowdstrike environment.
97
+
98
+Start the container with the below command:
99
+```bash
100
+docker compose -f /opt/CoPilot/data/data/CUSTOMER_NAME/CUSTOMER_NAME_docker-compose.yml up -d
101
+```
102
+
103
+You should now see the container running:
104
+
frontend/public/images/crowdstrike/docker_ps.PNG
Binary files /dev/null and b/frontend/public/images/crowdstrike/docker_ps.PNG differ