Skip to content

Commit 054150b

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #279766 from cwatson-cat/7-1-24-cs-ti-dc
Sentinel auto gen data connector - add Crowdstrike Falcon AI
2 parents d2a4987 + 3248428 commit 054150b

File tree

3 files changed

+140
-1
lines changed

3 files changed

+140
-1
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,8 @@
466466
href: data-connectors/corelight-connector-exporter.md
467467
- name: Cortex XDR - Incidents
468468
href: data-connectors/cortex-xdr-incidents.md
469+
- name: CrowdStrike Falcon Adversary Intelligence (using Azure Functions)
470+
href: data-connectors/crowdstrike-falcon-adversary-intelligence.md
469471
- name: Crowdstrike Falcon Data Replicator (using Azure Functions)
470472
href: data-connectors/crowdstrike-falcon-data-replicator.md
471473
- name: Crowdstrike Falcon Data Replicator V2 (using Azure Functions)

‎articles/sentinel/data-connectors-reference.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Find your Microsoft Sentinel data connector | Microsoft Docs
33
description: Learn about specific configuration steps for Microsoft Sentinel data connectors.
44
author: cwatson-cat
55
ms.topic: reference
6-
ms.date: 06/28/2024
6+
ms.date: 07/01/2024
77
ms.custom: linux-related-content
88
ms.author: cwatson
99
appliesto:
@@ -192,6 +192,7 @@ Contact the solution provider for more information or where information is unava
192192
## Crowdstrike
193193

194194
- [[Deprecated] CrowdStrike Falcon Endpoint Protection via Legacy Agent](data-connectors/deprecated-crowdstrike-falcon-endpoint-protection-via-legacy-agent.md)
195+
- [CrowdStrike Falcon Adversary Intelligence (using Azure Functions)](data-connectors/crowdstrike-falcon-adversary-intelligence.md)
195196
- [Crowdstrike Falcon Data Replicator (using Azure Functions)](data-connectors/crowdstrike-falcon-data-replicator.md)
196197
- [Crowdstrike Falcon Data Replicator V2 (using Azure Functions)](data-connectors/crowdstrike-falcon-data-replicator-v2.md)
197198

‎articles/sentinel/data-connectors/crowdstrike-falcon-adversary-intelligence.md

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
title: "CrowdStrike Falcon Adversary Intelligence (using Azure Functions) connector for Microsoft Sentinel"
3+
description: "Learn how to install the connector CrowdStrike Falcon Adversary Intelligence (using Azure Functions) to connect your data source to Microsoft Sentinel."
4+
author: cwatson-cat
5+
ms.topic: how-to
6+
ms.date: 07/01/2024
7+
ms.service: microsoft-sentinel
8+
ms.author: cwatson
9+
ms.collection: sentinel-data-connector
10+
---
11+
12+
# CrowdStrike Falcon Adversary Intelligence (using Azure Functions) connector for Microsoft Sentinel
13+
14+
The [CrowdStrike](https://www.crowdstrike.com/) Falcon Indicators of Compromise connector retrieves the Indicators of Compromise from the Falcon Intel API and uploads them [Microsoft Sentinel Threat Intel](/azure/sentinel/understand-threat-intelligence).
15+
16+
This is autogenerated content. For changes, contact the solution provider.
17+
18+
## Connector attributes
19+
20+
| Connector attribute | Description |
21+
| --- | --- |
22+
| **Azure function app code** | https://aka.ms/sentinel-CrowdStrikeFalconAdversaryIntelligence-Functionapp |
23+
| **Log Analytics table(s)** | IndicatorsOfCompromise<br/> |
24+
| **Data collection rules support** | Not currently supported |
25+
| **Supported by** | [Microsoft Corporation](https://support.microsoft.com) |
26+
27+
## Query samples
28+
29+
**Threat Intel - Crowdstrike Indicators of Compromise**
30+
31+
```kusto
32+
ThreatIntelligenceIndicator
33+
34+
| where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'
35+
36+
| sort by TimeGenerated desc
37+
```
38+
39+
40+
41+
## Prerequisites
42+
43+
To integrate with CrowdStrike Falcon Adversary Intelligence (using Azure Functions) make sure you have:
44+
45+
- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).
46+
- **CrowdStrike API Client ID and Client Secret**: **CROWDSTRIKE_CLIENT_ID**, **CROWDSTRIKE_CLIENT_SECRET**, **CROWDSTRIKE_BASE_URL**. CrowdStrike credentials must have Indicators (Falcon Intelligence) read scope.
47+
48+
49+
## Vendor installation instructions
50+
51+
52+
**STEP 1 - [Generate CrowdStrike API credentials](https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/).**
53+
54+
55+
56+
Make sure 'Indicators (Falcon Intelligence)' scope has 'read' selected
57+
58+
59+
**STEP 2 - [Register an Entra App](/entra/identity-platform/quickstart-register-app) with client secret.**
60+
61+
62+
63+
Provide the Entra App principal with 'Microsoft Sentinel Contributor' role assignment on the respective log analytics workspace. [How to assign roles on Azure](/azure/role-based-access-control/role-assignments-portal).
64+
65+
66+
**STEP 3 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
67+
68+
> [!IMPORTANT]
69+
> Before deploying the CrowdStrike Falcon Indicator of Compromise connector, have the Workspace ID (can be copied from the following).
70+
71+
72+
Option 1 - Azure Resource Manager (ARM) Template
73+
74+
Use this method for automated deployment of the CrowdStrike Falcon Adversary Intelligence connector using an ARM template.
75+
76+
1. Select the following **Deploy to Azure** button.
77+
78+
[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-CrowdStrikeFalconAdversaryIntelligence-azuredeploy)
79+
2. Provide the following parameters: CrowdStrikeClientId, CrowdStrikeClientSecret, CrowdStrikeBaseUrl, WorkspaceId, TenantId, Indicators, AadClientId, AadClientSecret, LookBackDays
80+
81+
Option 2 - Manual Deployment of Azure Functions
82+
83+
Use the following step-by-step instructions to deploy the CrowdStrike Falcon Adversary Intelligence connector manually with Azure Functions (Deployment via Visual Studio Code).
84+
85+
86+
**1. Deploy a Function App**
87+
88+
You need to [prepare VS Code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.
89+
90+
1. Download the [Azure Function App](https://aka.ms/sentinel-CrowdStrikeFalconAdversaryIntelligence-Functionapp) file. Extract archive to your local development computer.
91+
2. Start VS Code. Choose File in the main menu and select Open Folder.
92+
3. Select the top level folder from extracted files.
93+
4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.
94+
If you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**
95+
If you're already signed in, go to the next step.
96+
5. Provide the following information at the prompts:
97+
98+
a. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.
99+
100+
b. **Select Subscription:** Choose the subscription to use.
101+
102+
c. Select **Create new Function App in Azure** (Don't choose the Advanced option)
103+
104+
d. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CrowdStrikeFalconIOCXXXXX).
105+
106+
e. **Select a runtime:** Choose Python 3.9.
107+
108+
f. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.
109+
110+
6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.
111+
7. Go to Azure portal for the Function App configuration.
112+
113+
114+
**2. Configure the Function App**
115+
116+
1. In the Function App, select the Function App Name and select **Configuration**.
117+
2. In the **Application settings** tab, select **New application setting**.
118+
3. Add each of the following application settings individually, with their respective string values (case-sensitive):
119+
120+
- CROWDSTRIKE_CLIENT_ID
121+
- CROWDSTRIKE_CLIENT_SECRET
122+
- CROWDSTRIKE_BASE_URL
123+
- TENANT_ID
124+
- INDICATORS
125+
- WorkspaceKey
126+
- AAD_CLIENT_ID
127+
- AAD_CLIENT_SECRET
128+
- LOOK_BACK_DAYS
129+
- WORKSPACE_ID
130+
4. Once all application settings are entered, select **Save**.
131+
132+
133+
134+
## Next steps
135+
136+
For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-crowdstrikefalconep?tab=Overview) in the Azure Marketplace.

0 commit comments

Comments
 (0)