Skip to content

[Crowdstrike Falcon Endpoint Protection] - update solution to include… #13006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
v-dvedak merged 3 commits into from
Oct 24, 2025
Merged

[Crowdstrike Falcon Endpoint Protection] - update solution to include… #13006

v-dvedak merged 3 commits into from
Oct 24, 2025

Conversation

@srikarshastry
Copy link

@srikarshastry srikarshastry commented Oct 23, 2025

… updated API data connector

Required items, please complete

Change(s):

  • See guidance below

Reason for Change(s):

  • See guidance below

Version Updated:

  • Required only for Detections/Analytic Rule templates
  • See guidance below

Testing Completed:

  • See guidance below

Checked that the validations are passing and have addressed any issues that are present:

  • See guidance below

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

  • Updated syntax for XYZ.yaml

Reason for Change(s):

Version updated:

  • Yes
  • Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

  • Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

  • Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

@srikarshastry srikarshastry requested review from a team as code owners October 23, 2025 17:14
jlheard
jlheard previously approved these changes Oct 23, 2025
View reviewed changes
@srikarshastry
Copy link
Author

srikarshastry commented Oct 23, 2025

@microsoft-github-policy-service agree company="Microsoft"

@v-maheshbh v-maheshbh added the Solution Solution specialty review needed label Oct 24, 2025
@v-sabiraj v-sabiraj requested a review from Copilot October 24, 2025 06:01
Copilot AI reviewed Oct 24, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the CrowdStrike Falcon Endpoint Protection solution to version 3.1.6, addressing deprecated API issues in the CrowdStrike API Data Connector. The changes migrate the connector to use updated CrowdStrike API endpoints and improve the data collection configuration.

Key Changes:

  • Updated API endpoints from deprecated "queries" endpoints to "combined" endpoints for Vulnerabilities, Alerts, Detections, and Hosts
  • Migrated from nested API calls to direct combined endpoint calls, simplifying the data collection architecture
  • Updated stream naming convention from Custom-Crowdstrike-* to SENTINEL_CROWDSTRIKE* prefix
  • Removed data collection rule (DCR) stream declarations and transformKql configurations, as data transformations are now handled by the standard streams

Reviewed Changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file
File Description
Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 Updated standard stream mapping keys and values to align with new SENTINEL_ prefix naming convention
Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md Added version 3.1.6 release notes documenting the deprecated API fix
Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json Updated solution version, connector descriptions, API configurations, and removed Preview labels
Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json Fixed typo in solution description ("olution" to "solution")
Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json Updated solution version and added new data connector reference
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_PollingConfig.json Migrated to combined API endpoints, updated configuration parameters, and removed nested API calls
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_Definition.json Updated connector definition with corrected JSON structure and removed Preview status
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_DCR.json Removed extensive stream declarations and transformKql, simplified DCR configuration to use standard streams

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

v-sabiraj
v-sabiraj approved these changes Oct 24, 2025
View reviewed changes
Copy link
Contributor

@v-sabiraj v-sabiraj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From a solution perspective, it seems fine.
I trust that functional testing has been completed and the connector is operating as expected, since I noticed it was previously approved by some reviewers.

@v-dvedak v-dvedak merged commit c617479 into Azure:master Oct 24, 2025
32 checks passed
@v-sudkharat v-sudkharat linked an issue Oct 27, 2025 that may be closed by this pull request
CrowdStrikeAPI CCP Detections Decommissioned API Endpoint #12900
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@v-sabiraj v-sabiraj v-sabiraj approved these changes

@v-dvedak v-dvedak v-dvedak approved these changes

@jlheard jlheard jlheard left review comments

+2 more reviewers

@AmirSasson AmirSasson AmirSasson approved these changes

@pagoudjo pagoudjo pagoudjo approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@v-shukore v-shukore

Labels

Solution Solution specialty review needed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CrowdStrikeAPI CCP Detections Decommissioned API Endpoint

8 participants

@srikarshastry @jlheard @AmirSasson @pagoudjo @v-sabiraj @v-dvedak @v-shukore @v-maheshbh