You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Ingest CrowdStrike Falcon Detections and Incidents into TheHive Using an External Script
3
3
description: Install and configure the falcon2thehive connector to automatically ingest CrowdStrike Falcon detections and incidents into TheHive as alerts in real time.
4
-
tags:
4
+
tags:
5
5
- alert-ingestion
6
6
- crowdstrike
7
7
- thehive
8
8
- automation
9
9
---
10
10
# Tutorial: Ingest CrowdStrike Falcon Detections and Incidents into TheHive Using an External Script
In this tutorial, we're going to install and configure the [falcon2thehive connector](https://github.com/StrangeBeeCorp/falcon2thehive) to ingest CrowdStrike Falcon detections and incidents into TheHive as alerts.
15
15
16
-
In this tutorial, we're going to install and configure the [falcon2thehive connector](https://github.com/StrangeBeeCorp/falcon2thehive){target=_blank} to ingest CrowdStrike Falcon detections and incidents into TheHive as alerts.
17
-
18
-
By the end, you’ll have a working setup that automatically brings CrowdStrike Falcon detections and incidents into TheHive in real time, helping your team respond as soon as they happen.
16
+
By the end, you'll have a working setup that automatically brings CrowdStrike Falcon detections and incidents into TheHive in real time, helping your team respond as soon as they happen.
19
17
20
18
Before you begin, ensure that the CrowdStrike Falcon detections and incidents you want to ingest are part of the supported event types:
21
19
@@ -25,14 +23,14 @@ Before you begin, ensure that the CrowdStrike Falcon detections and incidents yo
25
23
* IdpDetectionSummaryEvent
26
24
* MobileDetectionSummaryEvent
27
25
28
-
!!! tip "More integration options"
29
-
For the complete list of integration options between CrowdStrike Falcon and TheHive, see [CrowdStrike Falcon Integration with TheHive](crowdstrike-falcon-integrations.md).
26
+
> **Tip:**More integration options
27
+
>For the complete list of integration options between CrowdStrike Falcon and TheHive, see [CrowdStrike Falcon Integration with TheHive](crowdstrike-falcon-integrations.md).
30
28
31
29
## Step 1: Create an API client in CrowdStrike Falcon
32
30
33
-
Let’s start by setting up an API client in your CrowdStrike Falcon console. This will allow the connector to securely access your detections and incidents.
31
+
Let's start by setting up an API client in your CrowdStrike Falcon console. This will allow the connector to securely access your detections and incidents.
34
32
35
-
1. Go to [https://www.crowdstrike.com/login/](https://www.crowdstrike.com/login/){target=_blank}.
33
+
1. Go to [https://www.crowdstrike.com/login/](https://www.crowdstrike.com/login/).
36
34
37
35
2. Log in to your CrowdStrike Falcon tenant with an administrator account.
38
36
@@ -46,33 +44,31 @@ Let’s start by setting up an API client in your CrowdStrike Falcon console. Th
46
44
47
45
7. Select **Create**.
48
46
49
-
8. You’ll now see your client ID, secret, and base URL. Copy and save them somewhere safe. You’ll need them in the next step.
47
+
8. You'll now see your client ID, secret, and base URL. Copy and save them somewhere safe. You'll need them in the next step.
50
48
51
49
## Step 2: Install and configure falcon2thehive
52
50
53
51
You can install the falcon2thehive connector using either a [Docker deployment](#docker-deployment) or a [manual installation](#manual-python-installation), depending on your setup and preferences. Docker is the recommended method for ease of deployment and consistency.
54
52
55
53
### Docker deployment
56
54
57
-
!!! note "Recommended installation method"
58
-
Installing the falcon2thehive connector with Docker is the easiest and most reliable option. It helps keep your environment clean and makes deployment straightforward.
59
-
60
-
!!! warning "Requirements"
61
-
Before you begin, make sure [Docker](https://docs.docker.com/get-started/get-docker/){target=_blank} is installed on your system.
55
+
> **Note:** Installing the falcon2thehive connector with Docker is the easiest and most reliable option. It helps keep your environment clean and makes deployment straightforward.
62
56
63
-
!!! tip "Quick testing"
64
-
If you just want to test the falcon2thehive connector, you can pass credentials directly as environment variables instead of using a `.env` file.
57
+
> **Warning:** Before you begin, make sure [Docker](https://docs.docker.com/get-started/get-docker/) is installed on your system.
| `CRWD_BASE_URL` | Yes | Your CrowdStrike Falcon base URL |
203
+
| `CRWD_CLIENT_ID` | Yes | API client ID from Step 1 |
204
+
| `CRWD_CLIENT_SECRET` | Yes | API client secret from Step 1 |
205
+
| `THEHIVE_URL` | Yes | URL of your TheHive instance |
206
+
| `THEHIVE_API_KEY` | Yes | API key for TheHive authentication |
207
+
| `THEHIVE_ORG` | No | Target organization in TheHive |
208
+
| `APP_ID` | No | Application ID for the CrowdStrike streaming API (default: `falcon2thehive`) |
199
209
200
210
5. Run the connector.
201
211
202
-
Now it’s time to start the connector.
212
+
Now it's time to start the connector.
203
213
204
214
* To run it in the background so it stays active while you continue working on other tasks:
205
215
@@ -213,8 +223,8 @@ At this point, the connector should be live and syncing CrowdStrike Falcon detec
213
223
python falcon2thehive.py
214
224
```
215
225
216
-
You should now start seeing CrowdStrike Falcon detections and incidents in your TheHive alert list. If you’re running it in the foreground, you should see log messages confirming a successful connection and alert ingestion.
226
+
You should now start seeing CrowdStrike Falcon detections and incidents in your TheHive alert list. If you're running it in the foreground, you should see log messages confirming a successful connection and alert ingestion.
217
227
218
-
<h2>Next steps</h2>
228
+
## Next steps
219
229
220
230
* [Synchronize Alert and Case Statuses from TheHive to CrowdStrike Falcon](synchronize-status-thehive-crowdstrike-falcon.md)
Copy file name to clipboardExpand all lines: integrations/vendors/CrowdstrikeFalcon/use-cases/synchronize-status-thehive-crowdstrike-falcon.md
+31-38Lines changed: 31 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,49 +1,47 @@
1
1
---
2
2
title: Synchronise status between TheHive alerts/cases and CrowdStrike detections/incidents
3
3
description: Keep case/alert status in sync between TheHive and CrowdStrike Falcon using notifications and the CrowdStrikeFalcon_Sync responder.
4
-
tags:
4
+
tags:
5
5
- status
6
6
- sync
7
7
- crowdstrike
8
8
- thehive
9
9
- automation
10
+
thehive_version_required: "5.0"
11
+
license_required: "platinum"
10
12
---
11
13
# Tutorial: Synchronize Alert and Case Statuses from TheHive to CrowdStrike Falcon
12
14
13
-
<!-- md:license Platinum -->
15
+
In this tutorial, we're going to install and configure the Cortex responder *[Status Sync](https://thehive-project.github.io/Cortex-Analyzers/responders/CrowdstrikeFalcon/#crowdstrikefalcon_sync)*.
14
16
15
-
In this tutorial, we're going to install and configure the Cortex responder *[Status Sync](https://thehive-project.github.io/Cortex-Analyzers/responders/CrowdstrikeFalcon/#crowdstrikefalcon_sync){target=_blank}*.
17
+
By the end, you'll have a setup that automatically keeps alert and case statuses in sync between TheHive and CrowdStrike Falcon, so that your investigations stay aligned across both platforms.
16
18
17
-
By the end, you’ll have a setup that automatically keeps alert and case statuses in sync between TheHive and CrowdStrike Falcon, so that your investigations stay aligned across both platforms.
19
+
> **Warning:** Prerequisites
20
+
> This tutorial assumes that you've already configured the ingestion of CrowdStrike Falcon detections and incidents into TheHive as alerts using [one of the available methods](crowdstrike-falcon-integrations.md#alert-ingestion).
18
21
19
-
!!! warning "Prerequisites"
20
-
This tutorial assumes that you've already configured the ingestion of CrowdStrike Falcon detections and incidents into TheHive as alerts using [one of the available methods](crowdstrike-falcon-integrations.md#alert-ingestion).
22
+
> **Note:** One-way sync
23
+
> This synchronization only works from TheHive to CrowdStrike Falcon. If you want to sync statuses the other way around, you'll need to implement a polling mechanism using an alert feeder.
21
24
22
-
!!! note "One-way sync"
23
-
This synchronization only works from TheHive to CrowdStrike Falcon. If you want to sync statuses the other way around, you’ll need to implement a polling mechanism using an [alert feeder](../../thehive/user-guides/organization/configure-organization/manage-feeders/about-feeders.md).
25
+
**Status mapping:**
24
26
25
-
!!! info "Status mapping"
27
+
| TheHive stage | CrowdStrike detection status | CrowdStrike incident status |
For the complete list of integration options between CrowdStrike Falcon and TheHive, see [CrowdStrike Falcon Integration with TheHive](crowdstrike-falcon-integrations.md).
33
+
> **Tip:** More integration options
34
+
> For the complete list of integration options between CrowdStrike Falcon and TheHive, see [CrowdStrike Falcon Integration with TheHive](crowdstrike-falcon-integrations.md).
To make the link between TheHive and CrowdStrike Falcon, we’ll start by [creating two custom fields](../../thehive/administration/custom-fields/create-a-custom-field.md) that will hold detection and incident IDs.
38
+
To make the link between TheHive and CrowdStrike Falcon, we'll start by creating two custom fields that will hold detection and incident IDs.
4. In the **Adding a custom field** drawer, enter the following information:
49
47
@@ -59,7 +57,7 @@ To make the link between TheHive and CrowdStrike Falcon, we’ll start by [creat
59
57
60
58
5. Select **Confirm custom field creation**.
61
59
62
-
6. Select :fontawesome-solid-plus: again.
60
+
6. Select **+** again.
63
61
64
62
7. In the **Adding a custom field** drawer, enter the following information:
65
63
@@ -77,9 +75,7 @@ To make the link between TheHive and CrowdStrike Falcon, we’ll start by [creat
77
75
78
76
## Step 2: Enable and configure the Status Sync responder in Cortex
79
77
80
-
<!-- md:permission `orgAdmin` -->
81
-
82
-
Now let’s enable and configure the *CrowdStrikeFalcon_Sync_1_0* responder in Cortex.
78
+
Now let's enable and configure the *CrowdStrikeFalcon_Sync_1_0* responder in Cortex.
83
79
84
80
1. Go to the **Organization** view.
85
81
@@ -89,26 +85,23 @@ Now let’s enable and configure the *CrowdStrikeFalcon_Sync_1_0* responder in C
89
85
90
86
4. Select **Edit** next to *CrowdStrikeFalcon_HostContainment_1_0*.
91
87
92
-
5. In the **Edit responder CrowdStrikeFalcon_HostContainment_1_0** drawer, enter the required details as described in the [Cortex Neurons documentation](https://thehive-project.github.io/Cortex-Analyzers/responders/CrowdstrikeFalcon/#crowdstrikefalcon_sync){target=_blank}.
88
+
5. In the **Edit responder CrowdStrikeFalcon_HostContainment_1_0** drawer, enter the required details as described in the [Cortex Neurons documentation](https://thehive-project.github.io/Cortex-Analyzers/responders/CrowdstrikeFalcon/#crowdstrikefalcon_sync).
93
89
94
90
The responder is now ready to run and synchronize statuses each time a change is detected in TheHive.
95
91
96
92
## Step 3: Create a notification in TheHive to trigger the responder
97
93
98
-
<!-- md:permission `manageConfig` -->
94
+
The last step is to automate the sync by triggering the responder when alert or case statuses change.
99
95
100
-
The last step is to automate the sync by [triggering the responder](../../thehive/user-guides/organization/configure-organization/manage-notifications/create-a-notification.md) when alert or case statuses change.
0 commit comments