CrowdStrike

The same connection details are used for all four CrowdStrike Integrations, as long as it has the required access.

Attention

Downloading Suricata rules from CrowdStrike requires a Falcon Intelligence Premium subscription. The Client ID and Client Secret need access to the following API: https://api.crowdstrike.com/intel/entities/rules-latest-files/v1

Downloading intel indicators from CrowdStrike requires a Falcon Intelligence subscription or better. The Client ID and Client Secret need access to the following API: https://api.crowdstrike.com/intel/combined/indicators/v1

General CrowdStrike configuration settings:

crowdstrike_config:
  id: "<FALCON_CLIENT_ID>"
  secret: "<FALCON_CLIENT_SECRET>"
  member_cid: "<FALCON_MEMBER_CID>"
  cloud: "<FALCON_CLOUD>"            # us-1, us-2, eu-1, us-gov-1
  host_override:
  base_path_override:
  debug:

Attention

The CrowdStrike Exposure Management integrations only create Input Framework files to be loaded on sensors. Additional Zeek scripts are required to be loaded on the sensors to use this data. If you enable these integrations, Corelight-update will upload the input files to the sensor. But if the desired script isn’t available on the sensor, the input data won’t be used.

See Zeek package management for information about using Corelight-update to manage Zeek package bundles.

See Zeek package references for examples of Zeek packages that can use this data.