CrowdStrike Falcon Intelligence Engine Integration User Guide

Overview

The ThreatConnect^® integration with CrowdStrike Falcon^® Intelligence allows ThreatConnect customers to import information Reports, Indicators, Signatures, Vulnerabilities, Malware, and Actors, along with all of their context, from the CrowdStrike Falcon Intelligence feed into ThreatConnect.

The following Indicator types are currently supported: Address, Email Address, File, Host, URL, Email Subject, Mutex, and Registry Key. Indicators are associated with Report and Intrusion Set Groups in ThreatConnect. Reports are also associated with Intrusion Set Groups in ThreatConnect.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) Key

CrowdStrike Dependencies

• Active subscription to CrowdStrike Falcon Intelligence with API key with the following permissions:
  • Actors: Read=Yes
  • Indicators: Read=Yes
  • Malware Families: Read=Yes
  • Reports: Read=Yes

Application Setup and Configuration

1. Log into ThreatConnect with a System Administrator account.
2. Install the CrowdStrike Falcon Intelligence Engine App via TC Exchange™.
3. Use the ThreatConnect Feed Deployer to set up and configure the CrowdStrike Falcon Intelligence Engine App.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the App.

CrowdStrike Falcon Intelligence Engine

After successfully configuring and activating the Feed API Service, you can access the CrowdStrike Falcon Intelligence Engine user interface (UI). This UI allows you to interact with and manage the CrowdStrike Falcon Intelligence integration.

Follow these steps to access the CrowdStrike Falcon Intelligence Engine UI:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Playbooks and select Services. The Services tab of the Playbooks screen will be displayed. 
3. Locate the CrowdStrike Falcon Intelligence Engine Feed API Service and then click the link in the Service’s API Path field. The DASHBOARD screen of the CrowdStrike Falcon Intelligence Engine UI will open in a new browser tab.

The following screens are available in the CrowdStrike Falcon Intelligence Engine UI:

• DASHBOARD
• JOBS
• TASKS
• DOWNLOAD
• REPORT

DASHBOARD

The DASHBOARD screen (Figure 1) provides an overview of the total number of Actors, Reports, Hashes, Domains, IP Addresses, and Email Addresses retrieved from CrowdStrike.

JOBS

The JOBS screen (Figure 2) breaks down the ingestion of CrowdStrike data into manageable Job-like tasks.

• Job Type: If desired, select a Job type by which to filter Jobs. Available types include  ad-hoc and scheduled. 
• Status:If desired, select a Job status by which to filter Jobs. Available statuses include the following:
  • Convert Complete
  • Convert In Progress
  • Download Complete
  • Download In Progress
  • Upload Complete
  • Upload In Progress
• Request ID: If desired, enter text into this box to search for a specific Job by its request ID.
• + Add Request: Click this button to display the ADD REQUEST window (Figure 3). On this window, you can specify the date range, Group types, and Indicator types for an ad-hoc Job request. After a Job request is added, it will be displayed in the table on the JOBS screen (Figure 2), and its Job type will be listed as ad-hoc.
  

   

TASKS

The TASKS screen (Figure 4) is where you can view and manage the Tasks for each Job.

DOWNLOADS

The DOWNLOADS screen (Figure 5) is where you can view data for Indicators, Actors, and Reports exactly as they appear in CrowdStrike.

• Type: Select the type of object to download. Available options include Actor, Indicators, and Reports.
• ID(s): Enter the CrowdStrike ID(s) for the object(s) to download. Data will be retrieved in JavaScript® Object Notation (JSON) format.
• Convert: Select this checkbox to convert the threat intelligence data to ThreatConnect batch format.
• Enrich: Select this checkbox to submit the threat intelligence data to the ThreatConnect Batch API.

REPORTS

The REPORTS screen provides two views: BATCH ERRORS and PDF TRACKER. The BATCH ERRORS screen (Figure 6) displays batch errors for each request in a tabular format. Details provided for each error include the error’s code, message, and reason.

The PDF TRACKER screen (Figure 7) is where you can view attempts ThreatConnect made to download PDF reports from CrowdStrike. The table on this screen displays the most recent date on which ThreatConnect attempted to download a PDF report, the number of times an attempt to download the report was made, and whether the report was downloaded successfully. You can also search for reports by ID on this screen, which can be useful if you do not see a CrowdStrike PDF report in ThreatConnect as expected.

Data Mappings

The data mappings in Table 2 through Table 10 illustrate how data are mapped from CrowdStrike API endpoints to the ThreatConnect data model.

Reports

ThreatConnect object type: Report Group

Actors

ThreatConnect object type: Intrusion Set Group

Actors-MITRE

ThreatConnect object type: Intrusion Set Group

Indicators

ThreatConnect object type: Indicator (all types)

Malware Families

ThreatConnect object type: Malware Group

Malware Families-MITRE

ThreatConnect object type: Malware Group

Yara Signatures

ThreatConnect object type: Signature Group

Vulnerabilities

ThreatConnect object type: Vulnerability Group

Troubleshooting

The CrowdStrike Falcon Intelligence Engine App is a Python^®-based App that requires certificate verification. Organizations using SSL inspection solutions will need to import their internal CA certificate to the OS-trusted root certificate store in order for the connection to CrowdStrike to be initiated.

Frequently Asked Questions (FAQ)

Why are some ATT&CK techniques represented as standard Tags instead of ATT&CK Tags in ThreatConnect?

ThreatConnect converts Tags that match an active ATT&CK technique name or ID into ATT&CK Tags automatically. When ThreatConnect ingests deprecated or inactive ATT&CK techniques from CrowdStrike, they are mapped to standard Tags to keep the data consistent between ThreatConnect and CrowdStrike. Note that standard Tags representing deprecated or inactive ATT&CK techniques will be applied only to Indicators in ThreatConnect, as these ATT&CK techniques are dropped for Actors and Malware.

Why are there no ATT&CK Tags applied to Reports?

ATT&CK Tag support for Reports is planned for a future update of the CrowdStrike Falcon Intelligence Engine App. If you need this update sooner, please contact your Customer Success Manager (CSM) or submit feedback via Productboard.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
CrowdStrike^® and CrowdStrike Falcon^® are registered trademarks of CrowdStrike, Inc.
JavaScript^® is a registered trademark of Oracle Corporation.
Python^® is a registered trademark of the Python Software Foundation.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

30039-09 EN Rev. A