Event Stream

Overview

Get a list of event streams from CrowdStrike Falcon.

Configuration

Parameters

Secrets

After entering the required parameters and secrets, you can choose to manually enter the Falcon API Alerts fields, or simply paste the given YAML:

Toggle this ON to enable a free text field where you can paste your CrowdStrike Falcon API YAML.

withTemporalWindow: true
temporalWindow:
  duration: 30m
  offset: 0
  tz: UTC
  format: Epoch
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: ${parameters.domain}/oauth2/token
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
      bodyType: urlEncoded
      bodyParams:
        - name: grant_type
          value: client_credentials
        - name: client_id
          value: '${secrets.client_id}'
        - name: client_secret
          value: '${secrets.client_secret}'
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: true
enumerationPhase:
  paginationType: none
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/sensors/entities/datafeed/v2
    queryParams:
      - name: appId
        value: my-datafeed-argos-onum-001
  output:
    select: ".resources[0]"
    map: "{dataFeedURL, sessionToken: .sessionToken.token}"
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: dataFeedURL
      expression: ".dataFeedURL"
      format: ''
    - source: input
      name: sessionToken
      expression: ".sessionToken"
      format: ''
  paginationType: none
  request:
    method: GET
    url: "${inputs.dataFeedURL}"
    headers:
      - name: Accept
        value: application/json
      - name: Authorization
        value: "Token ${inputs.sessionToken}"
    queryParams:
      - name: appId
        value: my-datafeed-argos-onum-001
      - name: whence
        value: 2
    responseType: ndjson
  output:
    select: "."
    map: "."
    outputMode: element

Temporal Window

Toggle ON to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

Duration - 30 minutes (30m) as default, adjust based on your needs.
Offset - initial offset should be 0 (the latest alert).
Format - Epoch

Authentication Phase

Toggle ON to configure the authentication phase. This is required to get the token to pull data using OAuth.

Type* - token
Request Method* - POST (we would need to generate the JWT using the secrets client_id and client_secret
URL* - ${parameters.domain}/oauth2/token
Headers
- Name - Content-type
- Value - application/x-www-form-urlencoded
BodyType* - UrlEncoded
- Body params
  - Name - grant_type
  - Value - client_credentials
  - Name - client_id
  - Value -'${secrets.clientID}'
  - Name - client_secret
  - Value - '${secrets.clientSecret}'
Token Path* - .access_token
Auth Injection
- In* - header
- Name* - authorization
- Prefix - Bearer
- Suffix - ''

Enumeration Phase

Toggle ON to configure the enumeration phase. This API endpoint requires an initial request that will provide a list of alert ids. In order to get the details about that information, it will require an additional request for those details.

Pagination Type* - None
Request
- Response Type* - JSON
- Method* - GET
- URL* - ${parameters.domain}/sensors/entities/datafeed/v2
- Query Params
  - Name - appId
  - Value - my-datafeed-argos-onum-001
Output
- Select - .resources[0]
- Map -{dataFeedURL, sessionToken: .sessionToken.token}
- Output Mode - element

Collection Phase

Variables
- Source - input
- Name - dataFeedURL
- Expression - .dataFeedURL
- Format - ''
- Source - input
- Name - sessionToken
- Expression - .sessionToken
- Format - ''
Pagination Type* - none
Request
- Method* - GET
- URL* - ${inputs.dataFeedURL}
- Headers -
  - Name - Accept
  - Value - application/json
  - Name - Authorization
  - Value - Token ${inputs.sessionToken}
Query Params
- Name - appId
- Value - my-datafeed-argos-onum-001
- Name - whence
- Value - 2
Output
- Select - .
- Map - .
- Output Mode - element

This HTTP Pull Listener now uses the data export API to extract events.

Click Create labels to move on to the next step and define the required Labels if needed.

PreviousAlerts NextIncidents

Last updated 15 days ago

Was this helpful?