Skip to content

Commit 733bd38

Browse files
OverOrionOverOrion
committed
feat: add crowdstrike connector
Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
1 parent eb98baa commit 733bd38

File tree

3 files changed

+202
-1
lines changed

3 files changed

+202
-1
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM ghcr.io/axoflow/axoflow-otel-collector/axoflow-otel-collector:0.129.0-axoflow.kafkareceiver AS axo-otelcol
1+
FROM ghcr.io/axoflow/axoflow-otel-collector/axoflow-otel-collector:0.129.0-axoflow.4 AS axo-otelcol
22

33
FROM alpine:3.21 AS base
44

‎connectors/crowdstrike/README.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
2+
# CrowdStrike Falcon Receiver
3+
4+
This directory contains the Axoflow CrowdStrike Falcon receiver which helps collecting alerts from the CrowdStrike Falcon platform.
5+
6+
## Quickstart
7+
8+
### Authentication with ClientID / ClientSecret
9+
10+
Make sure the required environment variables are set before running the receiver.
11+
12+
```bash
13+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
14+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
15+
16+
```bash
17+
docker run \
18+
--rm \
19+
-v "${STORAGE_DIRECTORY}":"${STORAGE_DIRECTORY}" \
20+
-e CROWDSTRIKE_CLIENT_ID="${CROWDSTRIKE_CLIENT_ID}" \
21+
-e CROWDSTRIKE_CLIENT_SECRET="${CROWDSTRIKE_CLIENT_SECRET}" \
22+
-e CROWDSTRIKE_CLOUD="${CROWDSTRIKE_CLOUD}" \
23+
-e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
24+
-e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
25+
-e AXOCLOUDCONNECTOR_DEVICE_ID="${AXOCLOUDCONNECTOR_DEVICE_ID}" \
26+
ghcr.io/axoflow/axocloudconnectors:latest
27+
```
28+
29+
### Authentication with Access Token
30+
31+
Make sure the required environment variables are set before running the receiver.
32+
33+
```bash
34+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
35+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
36+
37+
```bash
38+
docker run \
39+
--rm \
40+
-v "${STORAGE_DIRECTORY}":"${STORAGE_DIRECTORY}" \
41+
-e CROWDSTRIKE_ACCESS_TOKEN="${CROWDSTRIKE_ACCESS_TOKEN}" \
42+
-e CROWDSTRIKE_CLOUD="${CROWDSTRIKE_CLOUD}" \
43+
-e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
44+
-e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
45+
-e AXOCLOUDCONNECTOR_DEVICE_ID="${AXOCLOUDCONNECTOR_DEVICE_ID}" \
46+
ghcr.io/axoflow/axocloudconnectors:latest
47+
```
48+
49+
50+
## Deploy with Helm-chart (ClientID / ClientSecret)
51+
52+
```bash
53+
make minikube-cluster
54+
make docker-build
55+
make minikube-load-image
56+
57+
kubectl create namespace cloudconnectors
58+
kubectl create secret generic crowdstrike-falcon \
59+
--from-literal=client-id="<YOUR-CROWDSTRIKE-CLIENT-ID>" \
60+
--from-literal=client-secret="<YOUR-CROWDSTRIKE-CLIENT-SECRET>" \
61+
--from-literal=cloud="<YOUR-CROWDSTRIKE-CLOUD>" \
62+
--namespace cloudconnectors \
63+
--dry-run=client -o yaml | kubectl apply -f -
64+
65+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
66+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
67+
68+
helm upgrade --install --wait --namespace cloudconnectors cloudconnectors ./charts/cloudconnectors \
69+
--set image.repository="axocloudconnectors" \
70+
--set image.tag="dev" \
71+
--set 'env[0].name=AXOROUTER_ENDPOINT' \
72+
--set 'env[0].value=axorouter.axoflow-local.svc.cluster.local:4317' \
73+
--set 'env[1].name=AXOCLOUDCONNECTOR_DEVICE_ID' \
74+
--set "env[1].value=${AXOCLOUDCONNECTOR_DEVICE_ID}" \
75+
--set 'env[2].name=CROWDSTRIKE_CLIENT_ID' \
76+
--set 'env[2].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
77+
--set 'env[2].valueFrom.secretKeyRef.key=client-id' \
78+
--set 'env[3].name=CROWDSTRIKE_CLIENT_SECRET' \
79+
--set 'env[3].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
80+
--set 'env[3].valueFrom.secretKeyRef.key=client-secret' \
81+
--set 'env[4].name=CROWDSTRIKE_CLOUD' \
82+
--set 'env[4].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
83+
--set 'env[4].valueFrom.secretKeyRef.key=cloud'
84+
```
85+
86+
## Deploy with Helm-chart (Access Token)
87+
88+
```bash
89+
kubectl create secret generic crowdstrike-falcon \
90+
--from-literal=access-token="<YOUR-CROWDSTRIKE-ACCESS-TOKEN>" \
91+
--from-literal=cloud="<YOUR-CROWDSTRIKE-CLOUD>" \
92+
--namespace cloudconnectors \
93+
--dry-run=client -o yaml | kubectl apply -f -
94+
95+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
96+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
97+
98+
helm upgrade --install --wait --namespace cloudconnectors cloudconnectors ./charts/cloudconnectors \
99+
--set image.repository="axocloudconnectors" \
100+
--set image.tag="dev" \
101+
--set 'env[0].name=AXOROUTER_ENDPOINT' \
102+
--set 'env[0].value=axorouter.axoflow-local.svc.cluster.local:4317' \
103+
--set 'env[1].name=AXOCLOUDCONNECTOR_DEVICE_ID' \
104+
--set "env[1].value=${AXOCLOUDCONNECTOR_DEVICE_ID}" \
105+
--set 'env[2].name=CROWDSTRIKE_ACCESS_TOKEN' \
106+
--set 'env[2].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
107+
--set 'env[2].valueFrom.secretKeyRef.key=access-token' \
108+
--set 'env[3].name=CROWDSTRIKE_CLOUD' \
109+
--set 'env[3].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
110+
--set 'env[3].valueFrom.secretKeyRef.key=cloud'
111+
```
112+

‎connectors/crowdstrike/config.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
exporters:
2+
otlp/axorouter:
3+
endpoint: ${env:AXOROUTER_ENDPOINT}
4+
retry_on_failure:
5+
enabled: true
6+
max_elapsed_time: 0
7+
sending_queue:
8+
enabled: true
9+
storage: file_storage
10+
tls:
11+
insecure: ${env:AXOROUTER_TLS_INSECURE:-false}
12+
ca_file: ${env:AXOROUTER_TLS_CA_FILE}
13+
ca_pem: ${env:AXOROUTER_TLS_CA_PEM}
14+
cert_file: ${env:AXOROUTER_TLS_CERT_FILE}
15+
cert_pem: ${env:AXOROUTER_TLS_CERT_PEM}
16+
key_file: ${env:AXOROUTER_TLS_KEY_FILE}
17+
key_pem: ${env:AXOROUTER_TLS_KEY_PEM}
18+
min_version: ${env:AXOROUTER_TLS_MIN_VERSION:-1.2}
19+
max_version: ${env:AXOROUTER_TLS_MAX_VERSION}
20+
include_system_ca_certs_pool: ${env:AXOROUTER_TLS_INCLUDE_SYSTEM_CA_CERTS_POOL:-false}
21+
insecure_skip_verify: ${env:AXOROUTER_TLS_INSECURE_SKIP_VERIFY:-false}
22+
23+
processors:
24+
resource/axoflow_device_id:
25+
attributes:
26+
- key: "com.axoflow.device_id"
27+
action: insert
28+
value: "${env:AXOCLOUDCONNECTOR_DEVICE_ID}"
29+
30+
resourcedetection/system:
31+
detectors: ["system", "env"]
32+
system:
33+
hostname_sources: ["dns", "os", "cname", "lookup"]
34+
resource_attributes:
35+
host.name:
36+
enabled: true
37+
host.ip:
38+
enabled: true
39+
host.id:
40+
enabled: true
41+
42+
resource/axoflow: # Provider specific!
43+
attributes:
44+
- key: "com.axoflow.vendor"
45+
action: insert
46+
value: "crowdstrike"
47+
- key: "com.axoflow.product"
48+
action: insert
49+
value: "falcon"
50+
51+
receivers: # Provider specific!
52+
crowdstrike:
53+
access_token: ${env:CROWDSTRIKE_ACCESS_TOKEN}
54+
client_id: ${env:CROWDSTRIKE_CLIENT_ID}
55+
client_secret: ${env:CROWDSTRIKE_CLIENT_SECRET}
56+
member_cid: ${env:CROWDSTRIKE_MEMBER_CID}
57+
cloud: ${env:CROWDSTRIKE_CLOUD}
58+
host_override: ${env:CROWDSTRIKE_HOST_OVERRIDE}
59+
poll_interval: ${env:CROWDSTRIKE_POLL_INTERVAL}
60+
debug: ${CROWDSTRIKE_DEBUG}
61+
tls:
62+
insecure: ${env:CROWDSTRIKE_TLS_INSECURE:-false}
63+
insecure_skip_verify: ${env:CROWDSTRIKE_TLS_INSECURE_SKIP_VERIY:-false}
64+
server_name_override: ${env:CROWDSTRIKE_TLS_SERVER_NAME_OVERRIDE}
65+
ca_file: ${env:CROWDSTRIKE_TLS_CA_FILE}
66+
ca_pem: ${env:CROWDSTRIKE_TLS_CA_PEM}
67+
cert_file: ${env:CROWDSTRIKE_TLS_CERT_FILE}
68+
cert_pem: ${env:CROWDSTRIKE_TLS_CERT_PEM}
69+
key_file: ${env:CROWDSTRIKE_TLS_KEY_FILE}
70+
key_pem: ${env:CROWDSTRIKE_TLS_KEY_PEM}
71+
min_version: ${env:CROWDSTRIKE_TLS_MIN_VERSION:-1.2}
72+
max_version: ${env:CROWDSTRIKE_TLS_MAX_VERSION}
73+
include_system_ca_certs_pool: ${env:CROWDSTRIKE_TLS_INCLUDE_SYSTEM_CA_CERTS_POOL:-false}
74+
75+
extensions:
76+
health_check:
77+
endpoint: ${env:POD_IP}:13133
78+
file_storage:
79+
directory: ${env:STORAGE_DIRECTORY}
80+
create_directory: true
81+
82+
service:
83+
extensions: [health_check, file_storage]
84+
pipelines:
85+
logs:
86+
receivers: [crowdstrike]
87+
processors:
88+
[resource/axoflow_device_id, resourcedetection/system, resource/axoflow]
89+
exporters: [otlp/axorouter]

0 commit comments

Comments
 (0)