Falcon Threat Intelligence

The CrowdStrike Falcon Indicators integration will download all requested indicators at each interval.

There are several configurable options for CrowdStrike indicators. Select the malicious confidence level, how many days worth of history, and which indicators to collect.

Note

Due to the high number of hash indicators available, the length of history is configured separate from other types of indicators.

Intel Malicious confidence options are: “high”, “medium”, “low”, or “unverified”. The following definitions apply to malicious_confidence:

  • high: If indicator is an IP or domain, it has been associated with malicious activity within the last 60 days.

  • medium: If indicator is an IP or domain, it has been associated with malicious activity within the last 60-120 days.

  • low: If indicator is an IP or domain, it has been associated with malicious activity exceeding 120 days.

  • unverified: This indicator has not been verified by a CrowdStrike Intelligence analyst or an automated system.

Once downloaded, the data will be merged with all other intel files (if there are any), and published. If “intel” in enabled in the “push_content” settings, the file will automatically get pushed to the Fleet Manager policy and/or all sensors in the policy. See Push content settings for more details.

Settings

crowdstrike_indicators:
  enabled:                         false
  interval_hours:                  1
  request_limit:                   50000
  enable_do_notice:                true
  malicious_confidence:            high
  last_updated_days:               60
  hash_last_updated_days:          3
  indicator_type_ip_address:       true
  indicator_type_ip_address_block: true
  indicator_type_url:              true
  indicator_type_https_url:        false
  indicator_type_email_address:    true
  indicator_type_domain:           true
  indicator_type_x509_subject:     true
  indicator_type_username:         true
  indicator_type_hash_md5:         true
  indicator_type_hash_sha256:      false
  indicator_type_file_name:        true
  targets:
  threat_types:

Error

The default request limit is set to 50,000, which works for most customers. However, for some customer subscriptions the request limit cannot be more than 10,000 or an error is returned.

In addition to configuring which indicators to collect, you can also filter the indicators based on the type of target or the threat type.

  • To list a single Target or Threat Type, enter the string with both double quotes and single quotes.

  • To list multiple Targets or Threat Types, enter the string with both double quotes and square brackets around the entire string, and single quotes around each item.

Examples:

targets:         "'Aerospace'"
threat_types:    "['Commodity','Ransomware']"

Intel log

This integration will enrich the intel.log with content like the following:

  {
    "@path":"intel",
    "@sensor":"Lab-AP200",
    "@timestamp":"2023-01-06T05:13:38.841292Z",
    "ts":"2023-01-06T05:13:38.841292Z",
    "uid":"CNh51N3dSRfMZG1Pt4",
    "id.orig_h":"195.133.40.86",
    "id.orig_p":64910,
    "id.resp_h":"192.168.13.20",
    "id.resp_p":80,
    "seen.indicator":"77.247.181.165",
    "seen.indicator_type":"Intel::ADDR",
    "seen.where":"Conn::IN_ORIG",
    "matched": [
      "Intel::ADDR"
    ],
    "sources": [
      "blocklist_de",
      "cinsscore_ci_badguys",
      "blocklist_net_ua",
      "Mandiant",
      "dshield_block"
    ],
  }