CrowdStrike

CrowdStrike

1) Connector overview

Field
Value
Type
EDR, XDR
Vendor platform
 https://www.crowdstrike.com 
Vendor documentation
Available from your Falcon console, once signed in.
Pre-filtered link
Yes. Opens the list of the alerts raised in your Falcon console, filtered on the IP address of the target and on the execution window of the event.
API data retrieval
Yes. For each alert: name, severity, confidence, actions taken, date, description and command line. The actions taken tell you whether Falcon only detected the action or also prevented it, for example by killing or blocking a process. The name of the alert links to its details in the Falcon console.
Qualification modes
Automatic & Semi-automatic
Automatic behavior
Sets the Alerted detection status when at least one command reported by a CrowdStrike Falcon alert matches an IOC command of the BlackNoise event.
See  Connectors  for how the pre-filtered link, data collection and qualification modes work, and  Event statuses & severity  for the meaning of the detection statuses.

2) Configuration

Before you start

You need:
  • a Falcon account allowed to create API clients;
  • the region of your Falcon instance;
  • HTTPS access from BlackNoise to the Falcon API of your region.

Prepare CrowdStrike

BlackNoise reads your Falcon alerts through an API client, identified by a client ID and a client secret.
Step 1 - Create an API client. In your Falcon console, open API clients and keys and create a new API client for BlackNoise. Give it a recognizable name, for example blacknoise-connector.
Step 2 - Grant the Alerts scope. Grant the client the Alerts scope with Read access. This is the only scope BlackNoise needs: leave all the others unchecked.
Step 3 - Copy the credentials. Copy the Client ID and the Secret of the client. The secret is shown only once: store it in your password manager, and never paste it into a ticket or a chat.

Fill in the connector in BlackNoise

In BlackNoise, open Resources > Connectors and click Configure on the CrowdStrike card.
Field
What it is
Where to find it
Region
Region of your Falcon instance, to pick from the list: US-1, US-2, US-3 or EU-1. BlackNoise derives the API address and the Falcon links from it
In the address of your Falcon console: falcon.eu-1.crowdstrike.com is EU-1, and falcon.crowdstrike.com is US-1
Client ID
Identifier of the API client
Copied in step 3
Client secret
Secret of the API client
Copied in step 3
Click Save and connect. BlackNoise runs connection tests, and the connector becomes operational if they pass.