CrowdStrike

Crowdstrike

CrowdStrike’s security platform aims to stop breaches by offering advanced threat intelligence and real-time protection. CrowdStrike's solutions include endpoint protection, threat intelligence, and incident response services, all delivered through their cloud-based Falcon platform.

Integration

This integration is related to security findings. DataBee connects to CrowdStrike APIs to get data related to alerts, detections and incidents.

Integration Method: API

Tables: Device Config State, Detection Finding, Incident Finding, Process Activity, Authentication, DHCP Activity

Event Types: Events, Detections, Alerts

This integration has been tested against CrowdStrike API V1.

Crowdstrike Configuration

Before you start configuring data source on Databee UI, you will need to create the API Client and get the necessary information for API authentication such as Client ID and Client Secret.

To create API Client:

1. Log in to CrowdStrike Platform.

2. Navigate to the top-left navigation menu > Support and Resources > API Clients and Keys.

3. Click on Create API client button.

4. Enter Client Name to identify API client.

5. Provide a description that describes the purpose for the API client, if desired.

6. Select scope Alerts, Detection, and Incidents to fetch the required data.

7. Click on the create button.

8. Copy the Base URL, Client ID, and Client Secret.

9. Click Done.

Note: You will not be able to view this again after you complete this step. Ensure that you copy it before closing.

DataBee Configuration

1. To configure the Data Source, login into the DataBee UI, navigate to the Data tab, and click on Add New Data Source.

2. Search and click on the Crowdstrike

3. Click on the API Ingest option for collection method.  

4. Enter basic data source information and click Next

5. In the next dialog, enter the following:

• Authorization Method: OAuth2

• Key ID: Enter the Client Key ID saved from the previous step

• Secret Key: Enter the Client Secret saved from the previous step

If the URLs are not filled, use the following:

API URL: https://api.<region>.crowdstrike.com/alerts/queries/alerts/v2

API URL: https://api.<region>.crowdstrike.com/detects/queries/detects/v1

API URL: https://api.<region>.crowdstrike.com/incidents/queries/incidents/v1

Token URL: https://api.<region>.crowdstrike.com/oauth2/token

Replace the <region> with your tenant specific information.