About the Device
CrowdStrike Falcon Endpoint Detection and Response (EDR) is the core platform that provides endpoint security capabilities, threat detection, investigation, and response. It involves the deployment of lightweight agents on endpoints to monitor and protect against malicious activities.
CrowdStrike Data Replicator is a specific feature or component within the Falcon platform focused on data replication. This replication is beneficial for disaster recovery, forensic analysis, and threat hunting.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | CrowdStrike |
Product Name | EDR |
Type of Device | Cloud |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log Collection Method | Data Source |
|---|---|---|---|---|
CrowdStrike Falcon | CS_EDR (Data Replicator) | API Pull - JSON | C2C - Storage | https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_sqs |
CrowdStrike Detection Monitoring | CS_DETECTS (EDR Detections) | API Pull - JSON | C2C | https://cloud.google.com/chronicle/docs/reference/feed-management-api#cs-detects |
Device Configuration
Following are the configuration steps for Falcon EDR. This applies to the parser with the CS_DETECTS ingestion label:
In CrowdStrike application, create an API client by navigating to Support and resources > API clients and keys.
Create a new API Client and grant Read permissions under the API SCOPES.
Record the values for: Base URL + Client ID + Client Secret.
To Configure Data Replicator
Following are the configuration steps for Data Replicator, this applies to the parser with the CS_EDR ingestion label:
Click ADD to create a new Falcon Data Replicator feed. This will generate S3 identifier, SQS URL and Client secret.
Use the generated Feed, S3 identifier, SQS URL, and Client secret values to set up feed in Chronicle.
Integration Parameters
To set up a Data Replicator ingestion feed using S3:
Property | Default Value | Description |
|---|---|---|
Region | N/A | The S3 region associated with URI. |
S3 URI | N/A | The S3 bucket source URI. |
URI is a | N/A | The type of object URI points to. |
Source deletion option | N/A | Option to delete files and/or directories after transferring. |
Access key id | N/A | An account access key that is 20-character alphanumeric string, for example AKIAOSFOODNN7EXAMPLE. |
Secret access key | N/A | An account access key that is a 40-character alphanumeric string, for example wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY. |
Oauth client ID | N/A | A public, client-specific OAuth identifier. |
Oauth client secret | N/A | OAuth 2.0 client secret. |
Oauth secret refresh URI | N/A | OAuth 2.0 client secret refresh URI. |
Asset namespace | N/A | The namespace the feed will be associated with. |
To set up a Data Replicator ingestion feed using SQS:
Property | Default Value | Description |
|---|---|---|
Region | N/A | The S3 region associated with URI. |
Queue name | N/A | The SQS queue name to read from. |
Account number | N/A | The SQS account number. |
Source deletion option | N/A | Option to delete files and/or directories after transferring. |
Queue access key ID | N/A | An account access key that is 20-character alphanumeric string, for example, AKIAOSFOODNN7EXAMPLE. |
Queue secret access key | N/A | An account access key that is a 40-character alphanumeric string, for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY. |
Asset namespace | N/A | The namespace that the feed will be associated with. |
Detections:
Property | Default Value | Description |
|---|---|---|
OAuth token endpoint |
| Authentication URL |
OAuth client ID |
| OAuth Client ID |
OAuth client secret |
| OAuth Client Secret |
Base URL |
| API Endpoint URL api.crowdstrike.com |