From 081c942d944c651ea73c7331bb02260fd9ed8755 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 25 Oct 2024 18:07:21 +0530 Subject: [PATCH 1/4] CrowdStrike Spotlight app docs --- blog-service/2024-10-28-apps.md | 16 + cid-redirects.json | 1 + .../product-list/product-list-a-l.md | 2 +- .../saas-cloud/crowdstrike-spotlight.md | 446 ++++++++++++++++++ docs/integrations/saas-cloud/index.md | 6 + sidebars.ts | 1 + 6 files changed, 471 insertions(+), 1 deletion(-) create mode 100644 blog-service/2024-10-28-apps.md create mode 100644 docs/integrations/saas-cloud/crowdstrike-spotlight.md diff --git a/blog-service/2024-10-28-apps.md b/blog-service/2024-10-28-apps.md new file mode 100644 index 0000000000..e81a8b71b9 --- /dev/null +++ b/blog-service/2024-10-28-apps.md @@ -0,0 +1,16 @@ +--- +title: CrowdStrike Spotlight (Apps) +image: https://help.sumologic.com/img/sumo-square.png +keywords: + - crowdstrike-spotlight + - apps +hide_table_of_contents: true +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +We're excited to introduce the new CrowdStrike Spotlight app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud CrowdStrike Spotlight source to collect vulnerability logs through the CrowdStrike Spotlight API, helping you to obtain real-time visibility into vulnerabilities across your organization's assets to the security teams. + +Explore our technical documentation [here](/docs/integrations/saas-cloud/crowdstrike-spotlight/) to learn how to set up and use the CrowdStrike Spotlight app for Sumo Logic. \ No newline at end of file diff --git a/cid-redirects.json b/cid-redirects.json index 11b5e5b389..5752cebb47 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -2064,6 +2064,7 @@ "/cid/4018": "/docs/send-data/installed-collectors", "/cid/4019": "/docs/send-data/installed-collectors/sources/script-action", "/cid/4412": "/docs/integrations/saas-cloud/crowdstrike-fdr-host-inventory", + "/cid/44122": "/docs/integrations/saas-cloud/crowdstrike-spotlight", "/cid/4020": "/docs/search/logreduce", "/cid/4021": "/docs/search/search-query-language/search-operators/accum", "/cid/4022": "/docs/search/search-query-language/search-operators/fields", diff --git a/docs/integrations/product-list/product-list-a-l.md b/docs/integrations/product-list/product-list-a-l.md index a69deb5943..0382246958 100644 --- a/docs/integrations/product-list/product-list-a-l.md +++ b/docs/integrations/product-list/product-list-a-l.md @@ -168,7 +168,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [ | Thumbnail icon | [Couchbase](https://www.couchbase.com/) | Apps:
- [Couchbase](/docs/integrations/databases/couchbase/)
- [Couchbase - OpenTelemetry](/docs/integrations/databases/opentelemetry/couchbase-opentelemetry/) | | Thumbnail icon | [Cribl](https://cribl.io/) | Automation integration: [Cribl](/docs/platform-services/automation-service/app-central/integrations/cribl/)
Partner integration: [Cribl](https://docs.cribl.io/stream/destinations-sumo-logic/) | | Thumbnail icon | [Criminal IP](https://www.criminalip.io/) | Automation integration: [Criminal IP](/docs/platform-services/automation-service/app-central/integrations/criminal-ip) | -| Thumbnail icon | [CrowdStrike](https://www.crowdstrike.com/) | Apps:
- [CrowdStrike Falcon Endpoint Protection](/docs/integrations/security-threat-detection/crowdstrike-falcon-endpoint-protection/)
- [Threat Intel Quick Analysis](/docs/integrations/security-threat-detection/threat-intel-quick-analysis/)
- [CrowdStrike FDR Host Inventory](/docs/integrations/saas-cloud/crowdstrike-fdr-host-inventory)
Automation integrations:
- [CrowdStrike Falcon](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon/)
- [CrowdStrike Falcon Discover](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon-discover/)
- [CrowdStrike Falcon Intelligence](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon-intelligence/)
- [CrowdStrike Falcon Sandbox](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon-sandbox/)
Cloud SIEM integrations:
- [CrowdStrike](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/79ade329-b6d4-43ae-8db1-2a9cc45c0fb0.md)
- [PreemptSecurity](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/15c77a62-0fbb-4a60-9fae-ead49ec423f9.md)
Collectors:
- [CrowdStrike Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-source/)
- [Crowdstrike FDR Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-source/)
- [CrowdStrike FDR Host Inventory Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-host-inventory-source/)
- [CrowdStrike FileVantage Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-filevantage-source/)
- [CrowdStrike Spotlight Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-spotlight-source/) | +| Thumbnail icon | [CrowdStrike](https://www.crowdstrike.com/) | Apps:
- [CrowdStrike Falcon Endpoint Protection](/docs/integrations/security-threat-detection/crowdstrike-falcon-endpoint-protection/)
- [Threat Intel Quick Analysis](/docs/integrations/security-threat-detection/threat-intel-quick-analysis/)
- [CrowdStrike FDR Host Inventory](/docs/integrations/saas-cloud/crowdstrike-fdr-host-inventory)
- [CrowdStrike Spotlight](/docs/integrations/saas-cloud/crowdstrike-spotlight)
Automation integrations:
- [CrowdStrike Falcon](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon/)
- [CrowdStrike Falcon Discover](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon-discover/)
- [CrowdStrike Falcon Intelligence](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon-intelligence/)
- [CrowdStrike Falcon Sandbox](/docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon-sandbox/)
Cloud SIEM integrations:
- [CrowdStrike](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/79ade329-b6d4-43ae-8db1-2a9cc45c0fb0.md)
- [PreemptSecurity](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/15c77a62-0fbb-4a60-9fae-ead49ec423f9.md)
Collectors:
- [CrowdStrike Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-source/)
- [Crowdstrike FDR Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-source/)
- [CrowdStrike FDR Host Inventory Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-host-inventory-source/)
- [CrowdStrike FileVantage Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-filevantage-source/)
- [CrowdStrike Spotlight Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-spotlight-source/) | | Thumbnail icon | [Cuckoo](https://cuckoo.readthedocs.io/en/latest/#) | Automation integration: [Cuckoo](/docs/platform-services/automation-service/app-central/integrations/cuckoo/) | | Thumbnail icon | [CyberArk](https://www.cyberark.com/) | Automation integrations:
- [CyberArk AAM](/docs/platform-services/automation-service/app-central/integrations/cyberark-aam/)
- [CyberArk PAM](/docs/platform-services/automation-service/app-central/integrations/cyberark-pam)
Cloud SIEM integration: [CyberArk](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/8a3d333e-ffad-49ed-9edd-0cf1c797b24f.md)
Collector: [CyberArk EPM Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cyberark-source/) | | cyberint | [CyberInt](https://cyberint.com/) | Automation integration: [Cyberint](/docs/platform-services/automation-service/app-central/integrations/cyberint) | diff --git a/docs/integrations/saas-cloud/crowdstrike-spotlight.md b/docs/integrations/saas-cloud/crowdstrike-spotlight.md new file mode 100644 index 0000000000..328fc17129 --- /dev/null +++ b/docs/integrations/saas-cloud/crowdstrike-spotlight.md @@ -0,0 +1,446 @@ +--- +id: crowdstrike-spotlight +title: CrowdStrike Spotlight +sidebar_label: CrowdStrike Spotlight +description: The CrowdStrike Spotlight app for Sumo Logic provides real-time visibility into vulnerabilities across your organization's assets to the security teams. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +thumbnail icon + +The Sumo Logic app for CrowdStrike Spotlight offers real-time visibility into vulnerabilities across your organization's assets to the security teams. By integrating with CrowdStrike's powerful endpoint protection platform, the app helps security analysts monitor, detect, and prioritize vulnerabilities based on severity, operating system, internet exposure, and remediation status. + +This app provides enhanced threat intelligence through GeoLocation mapping of vulnerabilities, quick identification of top affected hosts, and insights into asset criticality. The app also tracks vulnerability remediation efforts, providing a clear view of progress and unresolved issues. With customizable dashboards and detailed logs, security teams can streamline their vulnerability management, ensuring they address critical threats promptly and minimize exposure to attacks. This integration ultimately strengthens an organization's overall security posture by enabling faster, data-driven decision-making in response to emerging vulnerabilities. + +:::info +This app includes [built-in monitors](#crowdstrike-spotlight-monitors). For details on creating custom monitors, refer to [Create monitors for CrowdStrike Spotlight app](#create-monitors-for-crowdstrike-spotlight-app). +::: + +## Log types + +This app uses Sumo Logic’s CrowdStrike Spotlight Source to collect [Vulnerability Logs](https://falcon.crowdstrike.com/documentation/98/spotlight-apis) from CrowdStrike Spotlight platform. + +## Sample log messages + +
+Click to expand + +```json title="Vulnerability Log" +{ + "id": "d5bde2e631d14103970a27924943a07c_9e90a7c915043320bbfc1534f438a60c", + "cid": "2ae7654232b94d7c99305e5bc5484ed1", + "aid": "d5bde2e631d14103970a27924943a07c", + "created_timestamp": "2022-03-08T19:56:57Z", + "updated_timestamp": "2023-03-10T21:03:22Z", + "status": "open", + "apps": [ + { + "product_name_version": "Graphics Driver", + "sub_status": "open", + "remediation": { + "ids": [ + "7f1f18c7a5d9327ca8552f297df0a282" + ] + }, + "evaluation_logic": { + "id": "94ad31682a3e3ee591bdce200865e1c7", + "cid": "2ae7654232b94d7c99305e5bc5484ed1", + "aid": "d5bde2e631d14103970a27924943a07c", + "created_timestamp": "2022-03-21T22:41:01Z", + "updated_timestamp": "2023-02-16T14:37:06Z", + "logic": [ + { + "id": 9532225801875003295, + "title": "Check if Windows 10 is installed", + "type": "inventory", + "negate": false, + "existence_check": "at_least_one_exists", + "comparison_check": "all", + "determined_by_comparison": true, + "comparisons": { + "state_operator": "AND", + "state_comparisons": [ + { + "entity_operator": "AND", + "entity_comparisons": [ + { + "actual_value_field": "value", + "expected_value": "^[a-zA-Z0-9\\(\\)\\s]*[Ww][Ii][Nn][Dd][Oo][Ww][Ss] 10[a-zA-Z0-9\\(\\)\\s]*$", + "operation": "pattern match", + "value_datatype": "string" + } + ] + } + ] + }, + "items": [ + { + "comparison_result": "true", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", + "name": "ProductName", + "type": "reg_sz", + "value": [ + "Windows 10 Pro" + ], + "windows_view": "64_bit" + } + ] + }, + { + "id": 16288502251398203820, + "title": "Check for the presence of referenced files igdumdim32.dll and igdumdim64.dll", + "type": "inventory", + "negate": false, + "existence_check": "at_least_one_exists", + "comparison_check": "", + "determined_by_comparison": false, + "items": [ + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0000", + "name": "UserModeDriverNameWow", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0001", + "name": "UserModeDriverNameWow", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0002", + "name": "UserModeDriverNameWow", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0003", + "name": "UserModeDriverNameWow", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2986-931D-11EB-8974-806E6F6E6963}\\0000", + "name": "UserModeDriverNameWow", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2986-931D-11EB-8974-806E6F6E6963}\\0001", + "name": "UserModeDriverNameWow", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2986-931D-11EB-8974-806E6F6E6963}\\0002", + "name": "UserModeDriverNameWow", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0000", + "name": "UserModeDriverName", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0001", + "name": "UserModeDriverName", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0002", + "name": "UserModeDriverName", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2985-931D-11EB-8974-806E6F6E6963}\\0003", + "name": "UserModeDriverName", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2986-931D-11EB-8974-806E6F6E6963}\\0000", + "name": "UserModeDriverName", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2986-931D-11EB-8974-806E6F6E6963}\\0001", + "name": "UserModeDriverName", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + }, + { + "comparison_result": "not evaluated", + "hive": "HKEY_LOCAL_MACHINE", + "item_type": "registry_item", + "key": "SYSTEM\\ControlSet001\\Control\\Video\\{C2BB2986-931D-11EB-8974-806E6F6E6963}\\0002", + "name": "UserModeDriverName", + "type": "reg_none", + "value": [ + "" + ], + "windows_view": "64_bit" + } + ] + }, + { + "id": 16392073654140156915, + "title": "Check if the version of igdkmd32.sys or igdkmd64.sys is less than 10.18.x.5057", + "type": "vulnerability", + "negate": false, + "existence_check": "at_least_one_exists", + "comparison_check": "at least one", + "determined_by_comparison": true, + "comparisons": { + "state_operator": "AND", + "state_comparisons": [ + { + "entity_operator": "AND", + "entity_comparisons": [ + { + "actual_value_field": "product_version", + "expected_value": "^10.18.\\d+.([0-4]?\\d?\\d?\\d?|504\\d|505[0-6])$", + "operation": "pattern match", + "value_datatype": "string" + } + ] + } + ] + }, + "items": [ + { + "comparison_result": "true", + "filename": "igdumdim64.dll", + "filepath": "C:\\Windows\\System32\\DriverStore\\FileRepository\\igdlh64.inf_amd64_5f8dc4eab6fcd2f0\\igdumdim64.dll", + "item_type": "file_item", + "product_name": "Intel HD Graphics Drivers for Windows 8(R)", + "product_version": "10.18.10.4252", + "version": "10.18.10.4252", + "windows_view": "64_bit" + }, + { + "comparison_result": "true", + "filename": "igdumdim32.dll", + "filepath": "C:\\Windows\\System32\\DriverStore\\FileRepository\\igdlh64.inf_amd64_5f8dc4eab6fcd2f0\\igdumdim32.dll", + "item_type": "file_item", + "product_name": "Intel HD Graphics Drivers for Windows 8(R)", + "product_version": "10.18.10.4252", + "version": "10.18.10.4252", + "windows_view": "64_bit" + } + ] + } + ] + } + } + ], + "suppression_info": { + "is_suppressed": false + }, + "host_info": { + "hostname": "W530", + "local_ip": "192.168.0.110", + "machine_domain": "", + "os_version": "Windows 10", + "ou": "", + "site_name": "", + "system_manufacturer": "LENOVO", + "tags": [], + "platform": "Windows", + "os_build": "19045", + "product_type_desc": "Workstation", + "host_last_seen_timestamp": "2023-06-07T00:00:00Z" + }, + "remediation": { + "entities": [ + { + "id": "7f1f18c7a5d9327ca8552f297df0a282", + "reference": "cpe:/a:intel:graphics_driver::::", + "title": "Update Intel Graphics Driver", + "action": "Update Intel Graphics Driver to the latest available version", + "link": "", + "vendor_url": "" + } + ] + }, + "cve": { + "id": "CVE-2018-12209", + "base_score": 3.3, + "severity": "LOW", + "exploit_status": 0, + "exprt_rating": "LOW", + "remediation_level": "O", + "cisa_info": { + "is_cisa_kev": false + }, + "spotlight_published_date": "2021-05-10T17:08:00Z", + "description": "Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to read device configuration information via local access.\n", + "published_date": "2019-03-14T20:29:00Z", + "vendor_advisory": [ + "https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00189.html" + ], + "references": [ + "https://support.lenovo.com/us/en/product_security/LEN-25084" + ], + "exploitability_score": 1.8, + "impact_score": 1.4, + "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } +} +``` +
+ +## Sample queries + +```sql title="Recent Access Activities" +_sourceCategory="Labs/CrowdstrikeSpotlight" +| json "status", "cve.severity", "id", "host_info.hostname", "suppression_info.is_suppressed", "host_info.internet_exposure", "host_info.platform", "host_info.os_version", "confidence", "cve.remediation_level", "host_info.asset_criticality", "host_info.local_ip", "remediation.entities[0].action", "host_info.system_manufacturer", "host_info.host_last_seen_timestamp", "created_timestamp", "updated_timestamp", "cve.id", "cve.base_score", "cve.exploitability_score" as status, severity, id, hostname, is_suppressed, internet_exposure, os_type, os_version, confidence, remediation_level, asset_criticality, local_ip, remediation_action, system_manufacturer, host_last_seen_timestamp, vuln_created_timestamp, vuln_updated_timestamp, cve_id, base_score, exploitability_score nodrop + +// global filters +| where status matches "{{status}}" +| where severity matches "{{severity}}" +| where os_type matches "{{os_type}}" + +| first(status) as status group by id +| where status matches ("*open") +| count by id +| count + +``` + +## Set up collection + +To set up the [CrowdStrike Spotlight Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-spotlight-source) for the CrowdStrike Spotlight app, follow the instructions provided. These instructions will guide you through the process of creating a source using the CrowdStrike Spotlight Source category, which you will need to use when installing the app. By following these steps, you can ensure that your CrowdStrike Spotlight app is properly integrated and configured to collect and analyze your CrowdStrike Spotlight data. + +## Installing the CrowdStrike Spotlight app​ + +import AppInstall2 from '../../reuse/apps/app-install-v2.md'; + + + +## Viewing CrowdStrike Spotlight dashboards​​ + +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + + +### Overview + +The CrowdStrike Spotlight - Overview dashboard provides security analysts with a comprehensive view of vulnerabilities across the organization's assets. Key panels display active vulnerabilities, closed vulnerabilities, and affected hosts, allowing for quick identification of critical security issues. + +The dashboard categorizes vulnerabilities by severity (Critical, High, Medium, and Low), operating system type (Windows and Linux), and internet exposure, helping analysts prioritize threats based on risk factors. GeoLocation data highlights the location of the most severe vulnerabilities aiding in threat localization. The panel showing vulnerabilities by remediation level tracks the organization's progress in resolving these issues. + +Analysts can also monitor top affected hosts, asset criticality, and vulnerabilities over time to spot trends and potential areas of concern. Additional detailed views provide information on vulnerability remediation actions, pending patches, and asset details, helping teams focus on closing security gaps promptly and efficiently.
CrowdStrike-Spotlight-Overview + +## Create monitors for CrowdStrike Spotlight app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + + +### CrowdStrike Spotlight monitors + +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | +|:--|:--|:--|:--| +| `Critical Vulnerabilities Detected` | This alert is triggered when critical security vulnerabilities are identified in your systems. These vulnerabilities are classified as high-risk and could be exploited by attackers to gain unauthorized access or cause significant damage. Immediate remediation is advised. | Critical | Count > 0 | +| `Unpatched Vulnerabilities` | This alert signals the presence of known vulnerabilities that remain unpatched. These unpatched vulnerabilities could potentially be leveraged by attackers and should be addressed through prompt patching or other mitigation strategies. | Critical | Count > 1| +| `Publicly Exposed Vulnerable Assets` | This alert is triggered when assets with known vulnerabilities are exposed to the public internet. These publicly exposed assets are more vulnerable to exploitation, posing a significant risk if left unaddressed. | Critical | Count > 0| +| `Exploit Status Change` | This alert notifies you when there is a change in the exploitability status of a known vulnerability. A status change indicates that a vulnerability has either become more or less susceptible to exploitation, which may require immediate action depending on the new status. | Critical | Count > 5| +| `Vulnerabilities Detected from Risky Locations` | This alert is activated when vulnerabilities are detected from high-risk geographical locations or IP addresses. This could indicate potential malicious activity, as risky locations often correlate with areas known for cybercrime. | Critical | Count > 0| + +## Upgrading the CrowdStrike Spotlight app (Optional) + +import AppUpdate from '../../reuse/apps/app-update.md'; + + + +## Uninstalling the CrowdStrike Spotlight app (Optional) + +import AppUninstall from '../../reuse/apps/app-uninstall.md'; + + \ No newline at end of file diff --git a/docs/integrations/saas-cloud/index.md b/docs/integrations/saas-cloud/index.md index 193285d418..a0165bc877 100644 --- a/docs/integrations/saas-cloud/index.md +++ b/docs/integrations/saas-cloud/index.md @@ -105,6 +105,12 @@ Learn about the Sumo Logic apps for SaaS and Cloud applications.

Monitor and manage your device security.

+
+
+ icon

CrowdStrike Spotlight

 +

Gather real-time visibility into the vulnerabilities.

+
+
Thumbnail icon

DocuSign

 diff --git a/sidebars.ts b/sidebars.ts index e0a5241080..0cdd680bb8 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -2450,6 +2450,7 @@ integrations: [ 'integrations/saas-cloud/citrix-cloud', 'integrations/saas-cloud/cloudflare', 'integrations/saas-cloud/crowdstrike-fdr-host-inventory', + 'integrations/saas-cloud/crowdstrike-spotlight', 'integrations/saas-cloud/datadog', 'integrations/saas-cloud/druva', 'integrations/saas-cloud/docusign', From be5a5eed71be3d76795e00ad1502a889b6e7b5ee Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 28 Oct 2024 19:31:49 +0530 Subject: [PATCH 2/4] Update docs/integrations/saas-cloud/crowdstrike-spotlight.md Co-authored-by: John Pipkin (Sumo Logic) --- docs/integrations/saas-cloud/crowdstrike-spotlight.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/saas-cloud/crowdstrike-spotlight.md b/docs/integrations/saas-cloud/crowdstrike-spotlight.md index 328fc17129..4f7e8a2204 100644 --- a/docs/integrations/saas-cloud/crowdstrike-spotlight.md +++ b/docs/integrations/saas-cloud/crowdstrike-spotlight.md @@ -11,7 +11,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; The Sumo Logic app for CrowdStrike Spotlight offers real-time visibility into vulnerabilities across your organization's assets to the security teams. By integrating with CrowdStrike's powerful endpoint protection platform, the app helps security analysts monitor, detect, and prioritize vulnerabilities based on severity, operating system, internet exposure, and remediation status. -This app provides enhanced threat intelligence through GeoLocation mapping of vulnerabilities, quick identification of top affected hosts, and insights into asset criticality. The app also tracks vulnerability remediation efforts, providing a clear view of progress and unresolved issues. With customizable dashboards and detailed logs, security teams can streamline their vulnerability management, ensuring they address critical threats promptly and minimize exposure to attacks. This integration ultimately strengthens an organization's overall security posture by enabling faster, data-driven decision-making in response to emerging vulnerabilities. +This app provides enhanced threat intelligence through geolocation mapping of vulnerabilities, quick identification of top affected hosts, and insights into asset criticality. The app also tracks vulnerability remediation efforts, providing a clear view of progress and unresolved issues. With customizable dashboards and detailed logs, security teams can streamline their vulnerability management, ensuring they address critical threats promptly and minimize exposure to attacks. This integration ultimately strengthens an organization's overall security posture by enabling faster, data-driven decision-making in response to emerging vulnerabilities. :::info This app includes [built-in monitors](#crowdstrike-spotlight-monitors). For details on creating custom monitors, refer to [Create monitors for CrowdStrike Spotlight app](#create-monitors-for-crowdstrike-spotlight-app). From 71119911f4091668833879d0d639c98605cb86b4 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 28 Oct 2024 19:31:56 +0530 Subject: [PATCH 3/4] Update docs/integrations/saas-cloud/crowdstrike-spotlight.md Co-authored-by: John Pipkin (Sumo Logic) --- docs/integrations/saas-cloud/crowdstrike-spotlight.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/saas-cloud/crowdstrike-spotlight.md b/docs/integrations/saas-cloud/crowdstrike-spotlight.md index 4f7e8a2204..27acd0e076 100644 --- a/docs/integrations/saas-cloud/crowdstrike-spotlight.md +++ b/docs/integrations/saas-cloud/crowdstrike-spotlight.md @@ -413,7 +413,7 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md'; The CrowdStrike Spotlight - Overview dashboard provides security analysts with a comprehensive view of vulnerabilities across the organization's assets. Key panels display active vulnerabilities, closed vulnerabilities, and affected hosts, allowing for quick identification of critical security issues. -The dashboard categorizes vulnerabilities by severity (Critical, High, Medium, and Low), operating system type (Windows and Linux), and internet exposure, helping analysts prioritize threats based on risk factors. GeoLocation data highlights the location of the most severe vulnerabilities aiding in threat localization. The panel showing vulnerabilities by remediation level tracks the organization's progress in resolving these issues. +The dashboard categorizes vulnerabilities by severity (Critical, High, Medium, and Low), operating system type (Windows and Linux), and internet exposure, helping analysts prioritize threats based on risk factors. Geolocation data highlights the location of the most severe vulnerabilities aiding in threat localization. The panel showing vulnerabilities by remediation level tracks the organization's progress in resolving these issues. Analysts can also monitor top affected hosts, asset criticality, and vulnerabilities over time to spot trends and potential areas of concern. Additional detailed views provide information on vulnerability remediation actions, pending patches, and asset details, helping teams focus on closing security gaps promptly and efficiently.
CrowdStrike-Spotlight-Overview From 9e01f2d397b80ddbd84a70c99546ee3f63a0849c Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Tue, 29 Oct 2024 10:13:20 +0530 Subject: [PATCH 4/4] Rename 2024-10-28-apps.md to 2024-10-29-apps.md --- blog-service/{2024-10-28-apps.md => 2024-10-29-apps.md} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename blog-service/{2024-10-28-apps.md => 2024-10-29-apps.md} (94%) diff --git a/blog-service/2024-10-28-apps.md b/blog-service/2024-10-29-apps.md similarity index 94% rename from blog-service/2024-10-28-apps.md rename to blog-service/2024-10-29-apps.md index e81a8b71b9..c83a03b82f 100644 --- a/blog-service/2024-10-28-apps.md +++ b/blog-service/2024-10-29-apps.md @@ -13,4 +13,4 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; We're excited to introduce the new CrowdStrike Spotlight app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud CrowdStrike Spotlight source to collect vulnerability logs through the CrowdStrike Spotlight API, helping you to obtain real-time visibility into vulnerabilities across your organization's assets to the security teams. -Explore our technical documentation [here](/docs/integrations/saas-cloud/crowdstrike-spotlight/) to learn how to set up and use the CrowdStrike Spotlight app for Sumo Logic. \ No newline at end of file +Explore our technical documentation [here](/docs/integrations/saas-cloud/crowdstrike-spotlight/) to learn how to set up and use the CrowdStrike Spotlight app for Sumo Logic.