Crowdstrike Falcon Intelligence

Updated 1 week ago by Elvis Hovor

This document explains how to set up and use Crowdstrike Falcon Intelligence with TruSTAR Station.

CrowdStrike Falcon Intelligence provides security teams with complete analysis and insights into the TTPs of adversary groups — allowing security professionals to diagnose and respond to incidents now, while more efficiently planning for events in the future — and preventing damage from advanced malware and targeted attacks.

  • Time to Install: 10 minutes
  • Type of Feed: Query-based
  • Update Frequency: Two hours
  • Intel Type: Premium Feed

Data Types

The integration pulls all observables supported by TruSTAR.

Requirements

  • Licensed user of Crowdstrike
  • Access to Crowdstrike Falcon Intelligence.
  • Crowdstrike API ID and API key for the reports API.
TruSTAR Admin rights are required to activate this Premium Intel feed.

Getting Started

  1. Log into TruSTAR Station.
  2. Click the Marketplace icon on the left side icon list.
  3. Choose Closed Sources.
  4. Click Subscribe on the Crowdstrike Falcon Reports box.
  5. Enter your API key and click Save Credentials & Request Subscription.

TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.

Known Issues

None reported.

Contact support@trustar.co if you have issues with this integration.


How Did We Do?