Crowdstrike Falcon Reports
This document explains how to set up and use Crowdstrike Falcon Reports with TruSTAR Station.
- Time to Install: 10 minutes
- Type of Feed: Automatic updates
- Update Frequency: 15 minutes
- Intel Type: Premium Feed
Data Types
The integration pulls all observables supported by TruSTAR.
Requirements
- Licensed user of Crowdstrike
- Access to Crowdstrike Falcon Intelligence Reports.
- Crowdstrike API ID and API key for the reports API.
Getting Started
- Log into TruSTAR Station.
- Click the Marketplace icon on the left side icon list.
- Click Closed Sources.
- Click Subscribe on the Crowdstrike Falcon Reports box.
- Enter your API key and click Save Credentials & Request Subscription.
TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.
Report Mapping
Field | Explanation |
Report Title | The ID name field of the response. Example: 9951 CSIT-17023 Stampado 2.0 Released |
External ID | The ID field of response. Example: 9951 |
Report Body | Entire JSON body resources list of the response. |
Time Begun | The created_date field of the response. Example: 1487684292 |
Report DeepLink | The URL of the report. Example: https://falcon.crowdstrike.com/intelligence/reports/csit-17023-stampado-2-0-released/) |
Tags | Slugs of the response. Example: US |
Known Issues
None reported.
