CrowdStrike Falcon Host uniquely combines an array of powerful methods to provide prevention against the rapidly changing tactics, techniques and procedures (TTPs) used by adversaries to breach organizations - including commodity malware, zero-day malware and even advanced malware-free attacks.

Connect CrowdStrike with LogicHub

1. Navigate to Automations > Integrations.
2. Search for CrowdStrike.
3. Click Details, then the + icon. Enter the required information in the following fields.
   • Label: Enter a connection name.
   • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
   • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
   • Remote Agent: Run this integration using the LogicHub Remote Agent.
   • URL: URL to your CrowdStrike Falcon Host (OAuth Based) instance. Example: https://api.crowdstrike.com
   • Client ID: Client ID of your CrowdStrike Falcon Host.
   • Client Secret: Client Secret of your CrowdStrike Falcon Host.
4. After you've entered all the details, click Connect.

Actions for CrowdStrike

Search Detections

Search for detection IDs that match a given query.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Detection details

Get Detection Details

Get detection details action allows you to view details for specific detections given one or more detection IDs.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• other fields of detections

Modify Detection

Change the state and assignee of one or more detections.

📘

Note

In addition to FalconX Scope, User Management [Read] Scope is also required for this integration action to work. This is required to create a mapping of the assignee uid (email) vs. the corresponding UUID to supply it to the remote API.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Successfully Updated

{
  "result": "Successfully updated",
  "error": null,
  "has_error": false
}

Search Devices

Search for devices based on a filter.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Device details

Get Device Details

Get device details action allows you to view details for specific devices given one or more device IDs.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• other fields of device

Search Processes

Search for processes associated with a custom IOC type.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Process details

Get Process Details

Retrieve the details of a process that is running or that previously ran, given one or more process IDs.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• other fields of process

Search IOCs

Search custom IOCs in your account

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: IOC details

Get IOC Details

Get IOC (Indicators of Compromise) details based on value and type.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• other fields of IOC

Create Custom IOCs

Create new IOCs to block custom domains, hashes or ips

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null

RTR Command: Single Host

Send Real-Time Response commands to a single host.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• stdout: output response of running the RTR command on the host
• stderr: error response of running the RTR command on the host

Take Action on Devices

Take various actions on the hosts in your environment. Contain or lift containment on hosts. Delete or restore hosts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: Successfully executed action on host

Search Incidents

Search for incidents by providing an FQL filter, sorting, and paging details.

Input Field

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• result: incident-id of a matched incident

{
  "error": null,
  "has_error": false,
  "result": "inc:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Get Incident Details

Get details on incidents by providing incident IDs.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• other keys containing incident details

{
  "incident_id": "inc:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "incident_type": 1,
  "cid": "c2f696880d9b4371b9760f7536078690",
  "host_ids": [
    "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  ],
  "hosts": [
    {
      "device_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
      "cid": "c2f696880d9b4371b9760f7536078690",
      "agent_load_flags": "0",
      "agent_local_time": "2020-09-23T13:51:08.032Z",
      "agent_version": "5.37.11804.0",
      "bios_manufacturer": "Apple Inc.",
      "bios_version": "199.0.0.0.0",
      "config_id_base": "65994753",
      "config_id_build": "11804",
      "config_id_platform": "4",
      "external_ip": "xx.xx.xx.xx",
      "hostname": "my-backup.local",
      "first_seen": "2020-07-20T04:09:07Z",
      "last_seen": "2020-09-23T14:11:08Z",
      "local_ip": "127.0.0.1",
      "mac_address": "xx-xx-xx-xx-xx-xx",
      "major_version": "19",
      "minor_version": "6",
      "os_version": "Catalina (10.15)",
      "platform_id": "1",
      "platform_name": "Mac",
      "product_type_desc": "Workstation",
      "status": "normal",
      "system_manufacturer": "Apple Inc.",
      "system_product_name": "MacBookPro11,4",
      "modified_timestamp": "2020-09-23T14:12:17Z"
    }
  ],
  "created": "2020-09-23T14:32:32Z",
  "start": "2020-09-23T14:32:32Z",
  "end": "2020-09-23T14:54:21Z",
  "state": "closed",
  "assigned_to": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "assigned_to_name": "Saurabh Prakash",
  "status": 40,
  "tactics": [
    "Persistence"
  ],
  "techniques": [
    "Modify Existing Service"
  ],
  "objectives": [
    "Keep Access"
  ],
  "modified_timestamp": "2020-09-23T14:45:15.179411419Z",
  "fine_score": 10,
  "error": null,
  "has_error": false
}

Falcon X Sandbox File Upload

Upload a file for sandbox analysis. After uploading, use Falcon X Sandbox Analysis to start analyzing the file.
Max file size: 100 MB.
Accepted file formats:

• Portable executables: .exe, .scr, .pif, .dll, .com, .cpl.
• Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub
• PDF
• APK
• Executable JAR
• Windows script component: .sct
• Windows shortcut: .lnk
• Windows help: .chm
• HTML application: .hta
• Windows script file: .wsf
• Javascript: .js
• Visual Basic: .vbs, .vbe
• Shockwave Flash: .swf
• Perl: .pl
• Powershell: .ps1, .psd1, .psm1
• Scalable vector graphics: .svg
• Python: .py
• Linux ELF executables
• Email files: MIME RFC 822 .eml, Outlook .msg.

Input Field

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• sha256: SHA256 hash of the uploaded file as reported by CrowdStrike
• file_name: file name of file uploaded

{
  "error": null,
  "has_error": false,
  "sha256": "42a615198bcdfc72839936409c88af7ded125feabfec4753b307dc985aaba48f",
  "file_name": "virus.exe"
}

Falcon X Sandbox Analysis

Submit either a URL or a sample SHA256 for sandbox analysis. For SHA256 analysis, a file needs to be uploaded to Falcon X first using the action Falcon X Sandbox File Upload. This action waits for the analysis to complete for each row of input. Use the appropriate number of Thread Count to make this action run faster (Recommended: max number of rows expected in the input table). As per Crowdstrike, the time required for each resource to be analyzed varies but is usually less than 15 minutes. Therefore, set Action Timeout appropriately.

Input Field

Output

A JSON object containing multiple rows of result:

• has_error: True/False
• error: message/null
• other keys representing the information in the report

{
  "id": "c2f696880d9b4371b9760f7536078690_d00d7b1b2c184d24a63d2c59d638a052",
  "cid": "c2f696880d9b4371b9760f7536078690",
  "created_timestamp": "2020-12-02T04:08:00Z",
  "origin": "apigateway",
  "sandbox": [
    {
      "sha256": "dac3aaa58e1796468ee1b96d8c1c59c8192bff99b1622a1cf09e71ea2a8f8e72",
      "environment_id": 100,
      "environment_description": "Windows 7 32 bit",
      "submit_name": "dac3aaa58e1796468ee1b96d8c1c59c8192bff99b1622a1cf09e71ea2a8f8e72",
      "submission_type": "file",
      "verdict": "no specific threat",
      "file_type": "PDF document, version 1.6",
      "sample_flags": [
        "Extracted Files"
      ]
    }
  ],
  "verdict": "no specific threat",
  "ioc_report_strict_csv_artifact_id": "65172ac1acf79d79958462f9123ee8f365f0e474c92185a2616adc2db2c19360",
  "ioc_report_broad_csv_artifact_id": "65172ac1acf79d79958462f9123ee8f365f0e474c92185a2616adc2db2c19360",
  "ioc_report_strict_json_artifact_id": "734de9198c5a6eae53e2a1a062e83ff9981d2c2a0cde4276a5235db5100cf795",
  "ioc_report_broad_json_artifact_id": "734de9198c5a6eae53e2a1a062e83ff9981d2c2a0cde4276a5235db5100cf795",
  "ioc_report_strict_stix_artifact_id": "205d28c146e45927ad04f99e6154a62682ec1f8fc5a62d8ff5005a8854c81717",
  "ioc_report_broad_stix_artifact_id": "205d28c146e45927ad04f99e6154a62682ec1f8fc5a62d8ff5005a8854c81717",
  "ioc_report_strict_maec_artifact_id": "0ad1af8daad615421fca9aa2bdbc3271a0225c3cee691f5d9fed2bacfa8e6190",
  "ioc_report_broad_maec_artifact_id": "0ad1af8daad615421fca9aa2bdbc3271a0225c3cee691f5d9fed2bacfa8e6190",
  "error": null,
  "has_error": false
}

Release Notes

• v2.0.0 - Updated architecture to support IO via filesystem
• v1.2.2 - Bug fix - Made severity field required in get Create Custom IOC action.
• v1.2.1 - Bug fix - Fix error message to show the original error/warnings from crowdstrike.