Incidents

Overview

Get a list of event streams from CrowdStrike Falcon.

Configuration

Parameters

• parameters.domain will store the value of the API URL, excluding the endpoint paths like /v1/cp/oauth/token or /v1/cp/incidents

Secrets

• Authorization (servicenow_auth)

Open the Secret fields and click New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

Learn more about secrets in Onum in this article.

You can now select the servicenow_auth secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Falcon API Alerts fields, or simply paste the given YAML:

Config as YAML

Toggle this ON to enable a free text field where you can paste your CrowdStrike Falcon API YAML.

withTemporalWindow: true
temporalWindow:
  duration: 1m
  offset: 1m
  tz: UTC
  format: "2006-01-02 15:04:05"
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: offsetLimit
  limit: 1000
  isZeroIndex: true
  request:
    responseType: json
    method: GET
    url: https://${parameters.domain}/api/now/v2/table/incident
    headers:
      - name: Authorization
        value: Basic ${secrets.ServiceNow_Basic_Base64}
    queryParams:
      - name: sysparm_query
        value: sys_updated_onBETWEEN${temporalWindow.from}@${temporalWindow.to}
      - name: sysparm_offset
        value: ${pagination.offset}
      - name: sysparm_limit
        value: ${pagination.limit}
      - name: sysparm_display_value
        value: false
  output:
    select: ".result"
    map: "."
    outputMode: element
retry:
  statusCodes: [429, 500, 502, 503, 504]
  type: fixed 
  fixed:
    interval: 2s

Manually configure

This HTTP Pull Listener now uses the data export API to extract incidents.

Click Create labels to move on to the next step and define the required Labels if needed.