CrowdStrike Falcon Streaming

Details
Content
Version History

Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events.

PUBLISHER

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Cortex XSOAR
Created	June 30, 2020
Last Release	November 28, 2021

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Automations

Name	Description
CrowdStrikeStreamingPreProcessing	Pre processing script for CrowdStrike Streaming, will not duplicate incidents(detection events) that have same Host. Will add entry to duplicate(older) incident notifying a duplicate incident was ignored. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html

Name

Description

CrowdStrikeStreamingPreProcessing

Pre processing script for CrowdStrike Streaming, will not duplicate incidents(detection events) that have same Host.
Will add entry to duplicate(older) incident notifying a duplicate incident was ignored.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html

Classifiers

Name	Description
CrowdStrike Falcon Streaming - Incoming Mapper	Maps incoming CrowdStrike Falcon event fields.
CrowdStrike Falcon Streaming - Classifier	Classifies CrowdStrike Falcon events.

Integrations

Name	Description
CrowdStrike Falcon Streaming v2	Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events.

1.1.1 - 2020903 (November 28, 2021)

Scripts

CrowdStrikeStreamingPreProcessing

Added reference to required permissions in automation's description and README.

1.1.0 - 1882648 (November 2, 2021)

Scripts

CrowdStrikeStreamingPreProcessing

Breaking Change: DBotRole has been removed from this automation.
This change will affect any playbook that is dependent on, or runs, this automation.
This automation will now run using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html

1.0.18 - 7567740 (September 12, 2021)

Scripts

CrowdStrikeStreamingPreProcessing

Updated the Docker image to: demisto/python:2.7.18.24066.

1.0.17 - 398245 (July 15, 2021)

Scripts

CrowdStrikeStreamingPreProcessing

Updated the Docker image to: demisto/python:2.7.18.20958.

1.0.16 - R264879 (January 27, 2021)

Integrations

CrowdStrike Falcon Streaming v2

Improved the handling of the discovery attempt for stream resources when they are not required.

1.0.15 - R261510 (January 25, 2021)

Integrations

CrowdStrike Falcon Streaming v2

Added support for stored event size validation in case storing sample events.

1.0.14 - 229790 (December 22, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Improved handling of 404 Not Found errors.
Added the Stream client read timeout integration parameter to set the stream read timeout.

1.0.13 - 208808 (December 2, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Improved handling of cases where event stream resources were not discovered.
Added a validation that checks if the app ID complies with the legal format (i.e., maximum of 32 alphanumeric characters (a-z,A-Z,0-9)).
Updated the Docker image to: demisto/aiohttp:1.0.0.13810.

1.0.12 - 184840 (November 12, 2020)

Integrations

CrowdStrike Falcon Streaming v2

General documentation improvements.

1.0.11 - R180529 (November 9, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Fixed an issue in which the request to refresh the stream session was not sent properly.

1.0.10 - 169974 (November 2, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Added handling for cases where the integration cache contained data of an unexpected type by converting it to be in the proper state.
Updateed the Docker image to: demisto/aiohttp:1.0.0.12815.

1.0.9 - 147456 (October 15, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Modified the integration to store the fetched event offset in the integration cache immediately on event fetch instead of storing it according to a schedule.
Upgraded the Docker image to demisto/aiohttp:1.0.0.12423.

1.0.8 - R124496 (September 23, 2020)

Scripts

CrowdStrikeStreamingPreProcessing

Updated the script to execute using the DBot role.

1.0.7 - 97858 (August 30, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Maintenance and stability enhancements.

1.0.6 - 96024 (August 26, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Improved handling when the stream response client is not completed.

1.0.5 - 93760 (August 24, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Improved error handling of unsupported media types.

1.0.4 - R84505 (August 10, 2020)

Integrations

CrowdStrike Falcon Streaming v2

Added default classifier and incoming mapper.
Added the First fetch timestamp parameter.
Added mapping of event creation time to incident occurred time.

1.0.3 - 60526 (June 30, 2020)

Integrations

CrowdStrike Falcon Streaming v2
Several bug fixes and improvements.