Skip to content

Commit cdcfc91

Browse files
JackTSquppyJackTSquppy
authored
Merge pull request #146 from squaredup/work/jt/crowdstrike-plugin
Add CrowdStrike plugin 🔥
2 parents 31334b9 + de18eba commit cdcfc91

25 files changed

Lines changed: 3362 additions & 0 deletions

‎plugins/CrowdStrike/v1/configValidation.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"steps": [
3+
{
4+
"displayName": "Authenticate",
5+
"dataStream": { "name": "currentUser" },
6+
"required": true,
7+
"error": "Could not authenticate. Check your Client ID, Client Secret and CrowdStrike Cloud region are correct, and that the API client has the Hosts: Read scope.",
8+
"success": "Connected successfully."
9+
}
10+
]
11+
}

‎plugins/CrowdStrike/v1/custom_types.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
[
2+
{
3+
"name": "CrowdStrike Host Group",
4+
"sourceType": "CrowdStrike Host Group",
5+
"icon": "layer-group",
6+
"singular": "Host Group",
7+
"plural": "Host Groups"
8+
},
9+
{
10+
"name": "CrowdStrike Host",
11+
"sourceType": "CrowdStrike Host",
12+
"icon": "desktop",
13+
"singular": "Host",
14+
"plural": "Hosts"
15+
}
16+
]

‎plugins/CrowdStrike/v1/dataStreams/alerts.json‎

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
{
2+
"name": "alerts",
3+
"displayName": "Alerts",
4+
"description": "Detections and incidents from the unified Falcon Alerts API, one row per alert, with computed detection and response latency",
5+
"tags": [
6+
"Security",
7+
"Alerts"
8+
],
9+
"baseDataSourceName": "httpRequestUnscoped",
10+
"config": {
11+
"httpMethod": "post",
12+
"endpointPath": "/alerts/combined/alerts/v1",
13+
"postBody": {
14+
"limit": 1000,
15+
"sort": "created_timestamp|desc",
16+
"filter": "{{ (typeof timeframe !== 'undefined' && timeframe && timeframe.start && timeframe.end ? [ \"created_timestamp:>'\" + timeframe.start.replace(/\\.\\d+Z$/, 'Z') + \"'+created_timestamp:<'\" + timeframe.end.replace(/\\.\\d+Z$/, 'Z') + \"'\" ] : []).concat(((S => S.length > 1 ? [ \"(\" + S.join(\",\") + \")\" ] : S)((typeof scope === 'undefined' || !scope ? [] : [ [\"device.device_id\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') < 0)], [\"device.groups\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') >= 0)] ].filter(p => p[1].length).map(p => p[0] + \":[\" + p[1].map(o => \"'\" + String([].concat(o.rawId !== undefined ? o.rawId : (o.sourceId || o.id))[0]).split('~').pop() + \"'\").join(\",\") + \"]\"))))).concat((typeof status === 'undefined' || !status || !status.length ? [] : [ \"status:[\" + status.map(s => \"'\" + (s.value || s) + \"'\").join(\",\") + \"]\" ])).join(\"+\") || \"created_timestamp:>'2000-01-01T00:00:00Z'\" }}"
17+
},
18+
"paging": {
19+
"mode": "token",
20+
"in": {
21+
"realm": "payload",
22+
"path": "meta.pagination.after"
23+
},
24+
"out": {
25+
"realm": "body",
26+
"path": "after"
27+
}
28+
},
29+
"pathToData": "resources",
30+
"expandInnerObjects": true,
31+
"errorHandling": {
32+
"type": "script",
33+
"script": "errorHandling/falconApiError.js"
34+
}
35+
},
36+
"matches": "none",
37+
"ui": [
38+
{
39+
"type": "objects",
40+
"name": "scope",
41+
"label": "Host or Host Group (optional)",
42+
"matches": {
43+
"sourceType": {
44+
"type": "oneOf",
45+
"values": [
46+
"CrowdStrike Host",
47+
"CrowdStrike Host Group"
48+
]
49+
}
50+
}
51+
},
52+
{
53+
"type": "choiceChips",
54+
"name": "status",
55+
"label": "Status",
56+
"isMulti": true,
57+
"options": [
58+
{
59+
"value": "new",
60+
"label": "New"
61+
},
62+
{
63+
"value": "in_progress",
64+
"label": "In Progress"
65+
},
66+
{
67+
"value": "closed",
68+
"label": "Closed"
69+
},
70+
{
71+
"value": "reopened",
72+
"label": "Reopened"
73+
}
74+
]
75+
}
76+
],
77+
"metadata": [
78+
{
79+
"name": "composite_id",
80+
"displayName": "ID",
81+
"shape": "string",
82+
"role": "id",
83+
"visible": false
84+
},
85+
{
86+
"name": "name",
87+
"displayName": "Name",
88+
"shape": "string",
89+
"role": "label"
90+
},
91+
{
92+
"name": "description",
93+
"displayName": "Description",
94+
"shape": "string"
95+
},
96+
{
97+
"name": "status",
98+
"displayName": "Status",
99+
"shape": "string"
100+
},
101+
{
102+
"name": "severity_name",
103+
"displayName": "Severity",
104+
"shape": "string"
105+
},
106+
{
107+
"name": "severity",
108+
"displayName": "Severity Score",
109+
"shape": "number"
110+
},
111+
{
112+
"name": "confidence",
113+
"displayName": "Confidence",
114+
"shape": "number"
115+
},
116+
{
117+
"name": "product",
118+
"displayName": "Product",
119+
"shape": "string"
120+
},
121+
{
122+
"name": "type",
123+
"displayName": "Alert Type",
124+
"shape": "string"
125+
},
126+
{
127+
"name": "tactic",
128+
"displayName": "Tactic",
129+
"shape": "string"
130+
},
131+
{
132+
"name": "technique",
133+
"displayName": "Technique",
134+
"shape": "string"
135+
},
136+
{
137+
"name": "device.device_id",
138+
"displayName": "Device ID",
139+
"shape": "string",
140+
"visible": false
141+
},
142+
{
143+
"name": "device.hostname",
144+
"displayName": "Hostname",
145+
"shape": "string"
146+
},
147+
{
148+
"name": "device.platform_name",
149+
"displayName": "Platform",
150+
"shape": "string"
151+
},
152+
{
153+
"name": "filename",
154+
"displayName": "File Name",
155+
"shape": "string"
156+
},
157+
{
158+
"name": "filepath",
159+
"displayName": "File Path",
160+
"shape": "string"
161+
},
162+
{
163+
"name": "cmdline",
164+
"displayName": "Command Line",
165+
"shape": "string"
166+
},
167+
{
168+
"name": "user_name",
169+
"displayName": "User",
170+
"shape": "string"
171+
},
172+
{
173+
"name": "tags",
174+
"displayName": "Tags",
175+
"shape": "string"
176+
},
177+
{
178+
"name": "created_timestamp",
179+
"displayName": "Created",
180+
"shape": "date",
181+
"role": "timestamp"
182+
},
183+
{
184+
"name": "updated_timestamp",
185+
"displayName": "Last Updated",
186+
"shape": "date"
187+
},
188+
{
189+
"name": "first_behavior",
190+
"displayName": "First Behavior",
191+
"shape": "date"
192+
},
193+
{
194+
"name": "last_behavior",
195+
"displayName": "Last Behavior",
196+
"shape": "date"
197+
},
198+
{
199+
"name": "detectionLatencySeconds",
200+
"displayName": "Detection Latency",
201+
"computed": true,
202+
"valueExpression": "{{ ($['first_behavior'] && $['created_timestamp']) ? Math.max(0, (new Date($['created_timestamp']) - new Date($['first_behavior'])) / 1000) : null }}",
203+
"shape": [
204+
"seconds",
205+
{
206+
"formatDuration": true
207+
}
208+
]
209+
},
210+
{
211+
"name": "responseLatencySeconds",
212+
"displayName": "Response Latency",
213+
"computed": true,
214+
"valueExpression": "{{ ($['seconds_to_triaged'] !== undefined && $['seconds_to_triaged'] !== null && $['seconds_to_triaged'] !== '' && !isNaN(Number($['seconds_to_triaged']))) ? Math.max(0, Number($['seconds_to_triaged'])) : null }}",
215+
"shape": [
216+
"seconds",
217+
{
218+
"formatDuration": true
219+
}
220+
]
221+
},
222+
{
223+
"sourceId": "device.device_id",
224+
"sourceType": "CrowdStrike Host",
225+
"name": "device.hostname"
226+
},
227+
{
228+
"pattern": ".*"
229+
}
230+
],
231+
"timeframes": true
232+
}

‎plugins/CrowdStrike/v1/dataStreams/currentUser.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"name": "currentUser",
3+
"displayName": "Host IDs",
4+
"description": "A minimal Falcon Hosts query, used only to verify the configured credentials can reach the API",
5+
"tags": ["Security"],
6+
"baseDataSourceName": "httpRequestUnscoped",
7+
"config": {
8+
"httpMethod": "get",
9+
"endpointPath": "/devices/queries/devices/v1",
10+
"getArgs": [{ "key": "limit", "value": "1" }],
11+
"paging": { "mode": "none" },
12+
"pathToData": "resources"
13+
},
14+
"matches": "none",
15+
"visibility": { "type": "hidden" },
16+
"metadata": [{ "pattern": ".*" }],
17+
"timeframes": false
18+
}

0 commit comments

Comments
 (0)