Skip to content

Commit c617479

Browse files
v-dvedakv-dvedak
authored
Merge pull request #13006 from srikarshastry/feature/srsistla/crowdStrikeApi
[Crowdstrike Falcon Endpoint Protection] - update solution to include…
2 parents f28cff2 + b392a6a commit c617479

File tree

9 files changed

+590
-2378
lines changed

9 files changed

+590
-2378
lines changed

‎Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_DCR.json‎

Lines changed: 12 additions & 825 deletions
Large diffs are not rendered by default.

‎Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_Definition.json‎

Lines changed: 167 additions & 166 deletions
Original file line numberDiff line numberDiff line change
@@ -1,172 +1,173 @@
11
{
2-
"name": "CrowdStrikeAPICCPDefinition",
3-
"apiVersion": "2023-04-01-preview",
4-
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
5-
"location": "[parameters('workspace-location')]",
6-
"kind": "Customizable",
7-
"properties": {
8-
"connectorUiConfig": {
9-
"id": "CrowdStrikeAPICCPDefinition",
10-
"title": "CrowdStrike API Data Connector (via Codeless Connector Framework) (Preview)",
11-
"publisher": "Microsoft",
12-
"descriptionMarkdown": "The [CrowdStrike Data Connector](https://www.crowdstrike.com/) allows ingesting logs from the CrowdStrike API into Microsoft Sentinel. This connector is built on the Microsoft Sentinel Codeless Connector Platform and uses the CrowdStrike API to fetch logs for Alerts, Detections, Hosts, Incidents, and Vulnerabilities. It supports DCR-based ingestion time transformations so that queries can run more efficiently.",
13-
"graphQueriesTableName": "CrowdStrikeVulnerabilities",
14-
"graphQueries": [
15-
{
16-
"metricName": "Total Vulnerability logs received",
17-
"legend": "CrowdStrike Vulnerability Logs",
18-
"baseQuery": "{{graphQueriesTableName}}"
19-
},
20-
{
21-
"metricName": "Total Alert logs received",
22-
"legend": "CrowdStrike Alert Logs",
23-
"baseQuery": "CrowdStrikeAlerts"
24-
},
25-
{
26-
"metricName": "Total Incident logs received",
27-
"legend": "CrowdStrike Incident Logs",
28-
"baseQuery": "CrowdStrikeIncidents"
29-
},
30-
{
31-
"metricName": "Total Detection logs received",
32-
"legend": "CrowdStrike Detection Logs",
33-
"baseQuery": "CrowdStrikeDetections"
34-
},
35-
{
36-
"metricName": "Total Host logs received",
37-
"legend": "CrowdStrike Host Logs",
38-
"baseQuery": "CrowdStrikeHosts"
39-
}
40-
],
41-
"sampleQueries": [
42-
{
43-
"description": "Get sample of CrowdStrike Vulnerability logs",
44-
"query": "{{graphQueriesTableName}}\n | take 10"
45-
},
46-
{
47-
"description": "Get sample of CrowdStrike Alert logs",
48-
"query": "CrowdStrikeAlerts\n | take 10"
49-
},
50-
{
51-
"description": "Get sample of CrowdStrike Incident logs",
52-
"query": "CrowdStrikeIncidents\n | take 10"
53-
},
54-
{
55-
"description": "Get sample of CrowdStrike Detection logs",
56-
"query": "CrowdStrikeDetections\n | take 10"
57-
},
58-
{
59-
"description": "Get sample of CrowdStrike Host logs",
60-
"query": "CrowdStrikeHosts\n | take 10"
61-
}
62-
],
63-
"dataTypes": [
64-
{
65-
"name": "{{graphQueriesTableName}}",
66-
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
67-
},
68-
{
69-
"name": "CrowdStrikeAlerts",
70-
"lastDataReceivedQuery": "CrowdStrikeAlerts\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
71-
},
72-
{
73-
"name": "CrowdStrikeIncidents",
74-
"lastDataReceivedQuery": "CrowdStrikeIncidents\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
75-
},
76-
{
77-
"name": "CrowdStrikeDetections",
78-
"lastDataReceivedQuery": "CrowdStrikeDetections\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
79-
},
80-
{
81-
"name": "CrowdStrikeHosts",
82-
"lastDataReceivedQuery": "CrowdStrikeHosts\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
83-
}
84-
],
85-
"connectivityCriteria": [
86-
{
87-
"type": "HasDataConnectors",
88-
"value": null
89-
}
90-
],
91-
"availability": {
92-
"status": 1,
93-
"isPreview": false
2+
"name": "CrowdStrikeAPICCPDefinition",
3+
"apiVersion": "2024-09-01",
4+
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
5+
"location": "[parameters('workspace-location')]",
6+
"kind": "Customizable",
7+
"properties": {
8+
"connectorUiConfig": {
9+
"id": "CrowdStrikeAPICCPDefinition",
10+
"title": "CrowdStrike API Data Connector (via Codeless Connector Framework)",
11+
"publisher": "Microsoft",
12+
"descriptionMarkdown": "The [CrowdStrike Data Connector](https://www.crowdstrike.com/) allows ingesting logs from the CrowdStrike API into Microsoft Sentinel. This connector is built on the Microsoft Sentinel Codeless Connector Platform and uses the CrowdStrike API to fetch logs for Alerts, Detections, Hosts, Incidents, and Vulnerabilities. It supports DCR-based ingestion time transformations so that queries can run more efficiently.",
13+
"graphQueriesTableName": "CrowdStrikeVulnerabilities",
14+
"graphQueries": [
15+
{
16+
"metricName": "Total Vulnerability logs received",
17+
"legend": "CrowdStrike Vulnerability Logs",
18+
"baseQuery": "{{graphQueriesTableName}}"
19+
},
20+
{
21+
"metricName": "Total Alert logs received",
22+
"legend": "CrowdStrike Alert Logs",
23+
"baseQuery": "CrowdStrikeAlerts"
24+
},
25+
{
26+
"metricName": "Total Incident logs received",
27+
"legend": "CrowdStrike Incident Logs",
28+
"baseQuery": "CrowdStrikeIncidents"
29+
},
30+
{
31+
"metricName": "Total Detection logs received",
32+
"legend": "CrowdStrike Detection Logs",
33+
"baseQuery": "CrowdStrikeDetections"
34+
},
35+
{
36+
"metricName": "Total Host logs received",
37+
"legend": "CrowdStrike Host Logs",
38+
"baseQuery": "CrowdStrikeHosts"
39+
}
40+
],
41+
"sampleQueries": [
42+
{
43+
"description": "Get sample of CrowdStrike Vulnerability logs",
44+
"query": "{{graphQueriesTableName}}\n | take 10"
45+
},
46+
{
47+
"description": "Get sample of CrowdStrike Alert logs",
48+
"query": "CrowdStrikeAlerts\n | take 10"
49+
},
50+
{
51+
"description": "Get sample of CrowdStrike Incident logs",
52+
"query": "CrowdStrikeIncidents\n | take 10"
53+
},
54+
{
55+
"description": "Get sample of CrowdStrike Detection logs",
56+
"query": "CrowdStrikeDetections\n | take 10"
57+
},
58+
{
59+
"description": "Get sample of CrowdStrike Host logs",
60+
"query": "CrowdStrikeHosts\n | take 10"
61+
}
62+
],
63+
"dataTypes": [
64+
{
65+
"name": "{{graphQueriesTableName}}",
66+
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
67+
},
68+
{
69+
"name": "CrowdStrikeAlerts",
70+
"lastDataReceivedQuery": "CrowdStrikeAlerts\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
71+
},
72+
{
73+
"name": "CrowdStrikeIncidents",
74+
"lastDataReceivedQuery": "CrowdStrikeIncidents\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
75+
},
76+
{
77+
"name": "CrowdStrikeDetections",
78+
"lastDataReceivedQuery": "CrowdStrikeDetections\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
79+
},
80+
{
81+
"name": "CrowdStrikeHosts",
82+
"lastDataReceivedQuery": "CrowdStrikeHosts\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
83+
}
84+
],
85+
"connectivityCriteria": [
86+
{
87+
"type": "HasDataConnectors"
88+
}
89+
],
90+
"availability": {
91+
"isPreview": true,
92+
"status": 1
93+
},
94+
"permissions": {
95+
"resourceProvider": [
96+
{
97+
"provider": "Microsoft.OperationalInsights/workspaces",
98+
"permissionsDisplayText": "Read and Write permissions are required.",
99+
"providerDisplayName": "Workspace",
100+
"scope": "Workspace",
101+
"requiredPermissions": {
102+
"write": true,
103+
"read": true,
104+
"delete": true
105+
}
106+
}
107+
]
108+
},
109+
"instructionSteps": [
110+
{
111+
"title": "Configuration steps for the CrowdStrike API",
112+
"description": "Follow the instructions below to obtain your CrowdStrike API credentials.",
113+
"instructions": [
114+
{
115+
"type": "Markdown",
116+
"parameters": {
117+
"content": "#### Configuration steps for the CrowdStrike API\nFollow the instructions below to obtain your CrowdStrike API credentials."
118+
}
119+
},
120+
{
121+
"type": "Markdown",
122+
"parameters": {
123+
"content": "#### 1. Retrieve API URL\nLog in to your CrowdStrike Console and navigate to the API section to copy your Base API URL."
124+
}
125+
},
126+
{
127+
"type": "Markdown",
128+
"parameters": {
129+
"content": "#### 2. Retrieve Client Credentials\nObtain your Client ID and Client Secret from the API credentials section in your CrowdStrike account."
130+
}
131+
},
132+
{
133+
"type": "Textbox",
134+
"parameters": {
135+
"label": "Base API URL",
136+
"placeholder": "https://api.us-2.crowdstrike.com",
137+
"type": "text",
138+
"name": "apiUrl"
139+
}
140+
},
141+
{
142+
"type": "Textbox",
143+
"parameters": {
144+
"label": "Client ID",
145+
"placeholder": "Your Client ID",
146+
"type": "text",
147+
"name": "clientId"
148+
}
94149
},
95-
"permissions": {
96-
"resourceProvider": [
97-
{
98-
"provider": "Microsoft.OperationalInsights/workspaces",
99-
"permissionsDisplayText": "Read and Write permissions are required.",
100-
"providerDisplayName": "Workspace",
101-
"scope": "Workspace",
102-
"requiredPermissions": {
103-
"read": true,
104-
"write": true,
105-
"delete": true,
106-
"action": false
107-
}
108-
}
109-
]
150+
{
151+
"type": "Textbox",
152+
"parameters": {
153+
"label": "Client Secret",
154+
"placeholder": "Your Client Secret",
155+
"type": "password",
156+
"name": "clientSecret"
157+
}
110158
},
111-
"instructionSteps": [
112-
{
113-
"instructions": [
114-
{
115-
"type": "Markdown",
116-
"parameters": {
117-
"content": "#### Configuration steps for the CrowdStrike API\nFollow the instructions below to obtain your CrowdStrike API credentials."
118-
}
119-
},
120-
{
121-
"type": "Markdown",
122-
"parameters": {
123-
"content": "#### 1. Retrieve API URL\nLog in to your CrowdStrike Console and navigate to the API section to copy your Base API URL."
124-
}
125-
},
126-
{
127-
"type": "Markdown",
128-
"parameters": {
129-
"content": "#### 2. Retrieve Client Credentials\nObtain your Client ID and Client Secret from the API credentials section in your CrowdStrike account."
130-
}
131-
},
132-
{
133-
"parameters": {
134-
"label": "Base API URL",
135-
"placeholder": "https://api.us-2.crowdstrike.com",
136-
"type": "text",
137-
"name": "apiUrl"
138-
},
139-
"type": "Textbox"
140-
},
141-
{
142-
"parameters": {
143-
"label": "Client ID",
144-
"placeholder": "Your Client ID",
145-
"type": "text",
146-
"name": "clientId"
147-
},
148-
"type": "Textbox"
149-
},
150-
{
151-
"type": "Textbox",
152-
"parameters": {
153-
"label": "Client Secret",
154-
"placeholder": "Your Client Secret",
155-
"type": "password",
156-
"name": "clientSecret"
157-
}
158-
},
159-
{
160-
"parameters": {
161-
"label": "toggle",
162-
"name": "toggle"
163-
},
164-
"type": "ConnectionToggleButton"
165-
}
166-
]
167-
}
168-
],
169-
"isConnectivityCriteriasMatchSome": false
159+
{
160+
"type": "ConnectionToggleButton",
161+
"parameters": {
162+
"connectLabel": "Connect",
163+
"disconnectLabel": "Disconnect",
164+
"name": "toggle"
165+
}
166+
}
167+
]
170168
}
169+
],
170+
"isConnectivityCriteriasMatchSome": false
171171
}
172+
}
172173
}

0 commit comments

Comments
 (0)