CrowdStrike Falcon Intelligence Engine Integration User Guide

Overview

The CrowdStrike Falcon® Intelligence Engine integration with ThreatConnect® lets you ingest Group (Actor, Malware, Report, and Vulnerability) and Indicator data, along with all of their context, from the CrowdStrike Falcon Intelligence feed into ThreatConnect.

The following ThreatConnect Indicator types are supported for import from CrowdStrike Falcon Intelligence: Address, CIDR, Email Address, Email Subject, File, Host, Mutex, Registry Key, URL, and User Agent. Indicators are associated with Report and Intrusion Set Groups when imported into ThreatConnect. Reports Groups are also associated with Intrusion Set Groups when imported into ThreatConnect. In both cases, the Intrusion Set Groups represent related Actor Groups imported from CrowdStrike Falcon Intelligence.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) Key

CrowdStrike Dependencies

• Active subscription to CrowdStrike Falcon Intelligence with API key with the following permissions:
  • Actors: Read=Yes
  • Indicators: Read=Yes
  • Malware Families: Read=Yes
  • Reports: Read=Yes

Application Setup and Configuration

Follow these steps to install the CrowdStrike Falcon Intelligence Engine App via TC Exchange™:

1. Log into ThreatConnect with a System Administrator account.
2. Hover over Settingson the top navigation bar and select TC Exchange Settings. Then select the Catalog tab on the TC Exchange Settings screen.
3. Locate the CrowdStrike Falcon Intelligence Engine App on the Catalog tab. Then click Install in the Options column to install the App.
4. After you install the CrowdStrike Falcon Intelligence Engine App, the Feed Deployer will open automatically. Use the Feed Deployer to set up and configure the App. See the “Configuration Parameters” section for more information on the parameters available during the configuration and deployment process.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the CrowdStrike Falcon Intelligence Engine App.

CrowdStrike Falcon Intelligence Engine UI

After successfully configuring and activating the Feed API Service, you can access the CrowdStrike Falcon Intelligence Engine user interface (UI). This UI allows you to interact with and manage the CrowdStrike Falcon Intelligence integration.

Follow these steps to access the CrowdStrike Falcon Intelligence Engine UI:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Playbooks and select Services.
3. Locate the CrowdStrike Falcon Intelligence Engine Feed API Service.
4. Click the link in the Service’s API Path field. The CrowdStrike Falcon Intelligence Engine UI will open in a new browser tab.

The following screens are available in the CrowdStrike Falcon Intelligence Engine UI:

• Dashboard
• Jobs
• Tasks
• Download
• Batch Errors
• Attachment Status

Dashboard

The Dashboard screen (Figure 1) provides an overview of the total number of each Group and Indicator type retrieved from CrowdStrike Falcon Intelligence. Depending on the available data, cards representing all or a subset of these objects will be displayed on the Dashboard screen.

Jobs

The Jobs screen (Figure 2) breaks down the ingestion of CrowdStrike Falcon Intelligence data into manageable Job-like tasks, displaying all processes that are pending, in progress, complete, and failed. The ⋯ menu in a Job’s row provides the following options:

• Details: View details for the Job, such as download, convert, and upload start and complete times and counts of downloaded and batched Groups and Indicators.
• Download Files: Download metadata files for all Jobs and data (convert, download, and upload) files for completed Jobs.
• Batch Errors: View errors that have occurred for the Job on the Batch Errors screen.

You can filter CrowdStrike Falcon Intelligence Engine App Jobs by the following elements:

• Job ID: Enter text into this box to search for a Job by its Job ID.
• Job Type: Select Job types to display on the Jobs screen.
• Status: Select Job statuses to display on the Jobs screen.

Add a Job

You can add ad-hoc Jobs on the Jobs screen. Follow these steps to create a request for an ad-hoc Job for the CrowdStrike Falcon Intelligence Engine App:

1. Click the Add Job button at the upper right of the Jobs screen (Figure 2).
2. Fill out the fields on the Add Job drawer (Figure 3) as follows: 

    

   • Start Time: (Optional) Enter the time at which the Job should start.
   • End Time: (Optional) Enter the time by which the Job should end.
   • Group Types: (Optional) Select the CrowdStrike Falcon Intelligence Group types to include in the ad-hoc Job.
   • Indicator Types: (Optional) Select the CrowdStrike Falcon Intelligence Indicator types to include in the ad-hoc Job.
3. Click Submit to submit the request for the ad-hoc Job.

Tasks

The Tasks screen (Figure 4) displays all Tasks that may be part of a Job, including each step of the download, convert, and upload processes, as well as Tasks for the CrowdStrike Falcon Intelligence Engine App, such as Monitor, Scheduler, and Cleaner. The current status (Idle, Paused, or Running), name, description, and heartbeat timeout length, in minutes, are displayed for each Task. The ⋯ menu in a Task’s row provides the following options, depending on the Task’s status:

• Run (idle and paused Tasks only)
• Pause (idle and running Tasks only)
• Resume (paused Tasks only)
• Kill (running Tasks only)

Under the table is a dashboard where you can view runtime analytics.

Download

The Download screen (Figure 5) lets you download JavaScript® Object Notation (JSON) data for CrowdStrike Falcon Intelligence objects and then upload the data into ThreatConnect.

Follow these steps to download JSON data for a CrowdStrike Falcon Intelligence object on the Download screen and then upload the data into ThreatConnect:

1. Intel Type: Select a CrowdStrike Falcon Intelligence Group type (Actor, Malware, Report, or Vulnerability), or Indicator for all available CrowdStrike Falcon Intelligence Indicator types, to download.
2. ID(s): Enter one or more CrowdStrike External IDs for the objects to download, separating each ID with a comma. The Actor, Malware, and Vulnerability types can also take a name as input.
   Important

   When entering multiple IDs or names, do not add a space before or after the comma.
   Important

   If you enter a name that has a space in it (e.g., cobalt strike) and no results are returned, remove the space and try again (e.g., cobaltstrike). Actor types usually allow, but do not require, spaces (e.g., fancy bear and fancybear both yield results), whereas Malware types usually do not allow spaces.
3. Click Download. The JSON data will be displayed in two columns: Results (raw JSON data) and Converted (JSON data in ThreatConnect batch format) (Figure 6). 

    

4. Click Upload to submit the converted threat intelligence data via the ThreatConnect Batch API.

Batch Errors

The Batch Errors screen (Figure 7) displays an overview of the batch error types that have occurred for Job requests. You can enter keywords to filter by Job ID.

Click on an error type to open a drawer containing a table with details on all batch errors of that type (Figure 8). You can enter keywords to filter by reason for error.

Attachment Status

The Attachment Status screen (Figure 9) displays a table with details on ThreatConnect's attempts to download Report attachments from CrowdStrike Falcon Intelligence. You can enter CrowdStrike External IDs for Groups to filter the table by Group ID, which can be useful if you do not see a CrowdStrike Falcon Intelligence attachment in ThreatConnect as expected, or by status.

Data Mappings

The data mappings in Table 2 through Table 10 illustrate how data are mapped from CrowdStrike Falcon Intelligence API endpoints to the ThreatConnect data model.

Reports

ThreatConnect object type: Report Group

Actors

ThreatConnect object type: Intrusion Set Group

Actors-MITRE

ThreatConnect object type: Intrusion Set Group

Indicators

ThreatConnect object type: Indicator (all types)

Malware Families

ThreatConnect object type: Malware Group

Malware Families-MITRE

ThreatConnect object type: Malware Group

Vulnerabilities

ThreatConnect object type: Vulnerability Group

Troubleshooting

The CrowdStrike Falcon Intelligence Engine App is a Python^®-based App that requires certificate verification. Organizations using SSL inspection solutions will need to import their internal CA certificate to the OS-trusted root certificate store in order for the connection to CrowdStrike to be initiated.

Frequently Asked Questions (FAQ)

Why are some ATT&CK techniques represented as standard Tags instead of ATT&CK Tags in ThreatConnect?

ThreatConnect converts Tags that match an active ATT&CK technique name or ID into ATT&CK Tags automatically. When ThreatConnect ingests deprecated or inactive ATT&CK techniques from CrowdStrike, they are mapped to standard Tags to keep the data consistent between ThreatConnect and CrowdStrike. Note that standard Tags representing deprecated or inactive ATT&CK techniques will be applied only to Indicators in ThreatConnect, as these ATT&CK techniques are dropped for Actors and Malware.

Why are there no ATT&CK Tags applied to Reports?

ATT&CK Tag support for Reports is planned for a future update of the CrowdStrike Falcon Intelligence Engine App. If you need this update sooner, please contact your Customer Success Manager (CSM) or submit feedback via Productboard.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
CrowdStrike^® and CrowdStrike Falcon^® are registered trademarks of CrowdStrike, Inc.
JavaScript^® is a registered trademark of Oracle Corporation.
Python^® is a registered trademark of the Python Software Foundation.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

30039-010 EN Rev. A