Crowdstrike Falcon Intelligence
This document explains how to set up and use Crowdstrike Falcon Intelligence with TruSTAR Station.
CrowdStrike Falcon Intelligence provides security teams with complete analysis and insights into the TTPs of adversary groups — allowing security professionals to diagnose and respond to incidents now, while more efficiently planning for events in the future — and preventing damage from advanced malware and targeted attacks.
- Source Type: Premium Intel
- Update Type: Feed-based
- Time to Install: 10 minutes
Data Types
The integration pulls all observables supported by TruSTAR.
Requirements
- Licensed user of Crowdstrike
- Access to Crowdstrike Falcon Intelligence.
- Crowdstrike API ID and API key for the reports API.
Getting Started
- Log into TruSTAR Station.
- Click the Marketplace icon on the left side icon list.
- Choose Premium Intel.
- Click Subscribe on the Crowdstrike Falcon Reports box.
- Enter your API key and click Save Credentials & Request Subscription.
TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.
TruSTAR Report Mapping
Field | Explanation | Example |
Report Title | IP <IOC Value> | IP XX.45.72.XX |
External ID | IP<IOC Value> | IPXX.45.72.XX |
Report Body | Merged response as - {“indicator_details”: response of a, “device_impacted”: response of c, “processes_affected”: response of e} | |
Time Begun | 1523030628 (i.e. published_date field of response a) |
FAQ
Q: How do I find my Crowdstrike Falcon Intelligence API keys?
- Navigate to API Clients and Keys in the Crowdstrike portal
- If your keys have not already been created for the Indicators API scope then "Add new API client"
- From here select a Client Name and select the following API scope under the Read column
- Indicators
- Copy the keys and subscribe to the Crowdstrike Falcon Intelligence Marketplace source
Known Issues
None reported.
