CrowdStrike Falcon X v1.1.0

About the connector

Falcon X™ automates the threat analysis process and delivers actionable intelligence and custom IOCs specifically tailored for the threats encountered on your endpoints. With this level of automation, you can stop picking and choosing which threats to analyze and start analyzing all threats.

This document provides information about the CrowdStrike Falcon X connector, which facilitates automated interactions, with a CrowdStrike Falcon X server using FortiSOAR™ playbooks. Add the CrowdStrike Falcon X connector as a step in FortiSOAR™ playbooks and perform automated operations such as submitting a URL to the CrowdStrike Falcon X sandbox, retrieving reports from the CrowdStrike Falcon X sandbox, retrieving the status of a sandbox analysis from the CrowdStrike Falcon X sandbox, etc.

Version information

Connector Version: 1.1.0

Authored By: Fortinet

Certified: No

Release Notes for version 1.1.0

Following enhancements have been made to the CrowdStrike Falcon X Connector in version 1.1.0:

• Fixed issues with the following actions:
  • Submit URL was failing with the error Invalid number of sandbox parameters submitted
  • Submit Uploaded File was failing with the error Either sha256 or url attributes needs to be submitted, not both
  • Upload File was failing due to the incorrect content-type and payload specified in the API request.
  • Search Submission ID was failing due to incorrect payload in the api request.
• Added a new Interactivity parameter in Submit URL and Submit Uploaded File

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-crowdstrike-falcon-x

Prerequisites to configuring the connector

• You must have the credentials of CrowdStrike Falcon X server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the CrowdStrike Falcon X server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the CrowdStrike Falcon X connector row (if you are in the Grid view on the Connectors page), and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Upload File

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [
        {
            "file_name": "",
            "sha256": ""
        }
    ],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "pagination": {
            "limit": "",
            "offset": "",
            "total": ""
        },
        "powered_by": "",
        "query_time": "",
        "trace_id": "",
        "writes": {
            "resources_affected": ""
        }
    }
}

operation: Submit Uploaded File

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [
        {
            "cid": "",
            "created_timestamp": "",
            "id": "",
            "origin": "",
            "sandbox": [
                {
                    "action_script": "",
                    "command_line": "",
                    "document_password": "",
                    "enable_tor": true,
                    "environment_id": "",
                    "sha256": "",
                    "submit_name": "",
                    "system_date": "",
                    "system_time": "",
                    "url": ""
                }
            ],
            "state": "",
            "user_id": "",
            "user_name": "",
            "user_tags": [],
            "user_uuid": ""
        }
    ],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "MsaMetaInfo": {
            "pagination": {
                "limit": "",
                "offset": "",
                "total": ""
            },
            "powered_by": "",
            "query_time": "",
            "trace_id": "",
            "writes": {
                "resources_affected": ""
            }
        },
        "quota": {
            "in_progress": "",
            "total": "",
            "used": ""
        }
    }
}

operation: Get Full Report

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [
        {
            "cid": "",
            "created_timestamp": "",
            "id": "",
            "intel": [
                {
                    "actors": [
                        {
                            "created_timestamp": "",
                            "description": "",
                            "first_activity_timestamp": "",
                            "id": "",
                            "image_artifact_id": "",
                            "known_as": "",
                            "last_activity_timestamp": "",
                            "name": "",
                            "origins": [
                                {
                                    "id": "",
                                    "name": "",
                                    "slug": "",
                                    "value": ""
                                }
                            ],
                            "short_description": "",
                            "slug": "",
                            "target_countries": [
                                {
                                    "id": "",
                                    "name": "",
                                    "slug": "",
                                    "value": ""
                                }
                            ],
                            "target_industries": [
                                {
                                    "id": "",
                                    "name": "",
                                    "slug": "",
                                    "value": ""
                                }
                            ],
                            "thumbnail_artifact_id": ""
                        }
                    ],
                    "malware_families": [],
                    "related_indicators": [
                        {
                            "created_timestamp": "",
                            "id": "",
                            "type": "",
                            "updated_timestamp": "",
                            "value": ""
                        }
                    ]
                }
            ],
            "ioc_report_broad_csv_artifact_id": "",
            "ioc_report_broad_json_artifact_id": "",
            "ioc_report_broad_maec_artifact_id": "",
            "ioc_report_broad_stix_artifact_id": "",
            "ioc_report_strict_csv_artifact_id": "",
            "ioc_report_strict_json_artifact_id": "",
            "ioc_report_strict_maec_artifact_id": "",
            "ioc_report_strict_stix_artifact_id": "",
            "malquery": [
                {
                    "errors": [
                        {
                            "code": "",
                            "message": ""
                        }
                    ],
                    "input": "",
                    "resources": [
                        {
                            "family": "",
                            "file_size": "",
                            "file_type": "",
                            "first_seen_timestamp": "",
                            "label": "",
                            "md5": "",
                            "sha1": "",
                            "sha256": ""
                        }
                    ],
                    "type": "",
                    "verdict": ""
                }
            ],
            "origin": "",
            "sandbox": [
                {
                    "architecture": "",
                    "classification": [],
                    "classification_tags": [],
                    "contacted_hosts": [
                        {
                            "address": "",
                            "associated_runtime": [
                                {
                                    "name": "",
                                    "pid": ""
                                }
                            ],
                            "compromised": true,
                            "country": "",
                            "port": "",
                            "protocol": ""
                        }
                    ],
                    "dns_requests": [
                        {
                            "address": "",
                            "compromised": true,
                            "country": "",
                            "domain": "",
                            "registrar_creation_timestamp": "",
                            "registrar_name": "",
                            "registrar_name_servers": "",
                            "registrar_organization": ""
                        }
                    ],
                    "environment_description": "",
                    "environment_id": "",
                    "error_message": "",
                    "error_origin": "",
                    "error_type": "",
                    "extracted_files": [
                        {
                            "description": "",
                            "file_available_to_download": true,
                            "file_path": "",
                            "file_size": "",
                            "md5": "",
                            "name": "",
                            "runtime_process": "",
                            "sha1": "",
                            "sha256": "",
                            "threat_level": "",
                            "threat_level_readable": "",
                            "type_tags": []
                        }
                    ],
                    "extracted_interesting_strings": [
                        {
                            "filename": "",
                            "process": "",
                            "source": "",
                            "type": "",
                            "value": ""
                        }
                    ],
                    "file_imports": [
                        {
                            "functions": [],
                            "module": ""
                        }
                    ],
                    "file_metadata": {
                        "file_analysis": [],
                        "file_compositions": [],
                        "imported_objects": []
                    },
                    "file_size": "",
                    "file_type": "",
                    "file_type_short": [],
                    "http_requests": [
                        {
                            "header": "",
                            "host": "",
                            "host_ip": "",
                            "host_port": "",
                            "method": "",
                            "response_code": "",
                            "response_phrase": "",
                            "url": ""
                        }
                    ],
                    "incidents": [
                        {
                            "details": [],
                            "name": ""
                        }
                    ],
                    "ioc_report_broad_artifact_id": "",
                    "ioc_report_strict_artifact_id": "",
                    "memory_forensics": [
                        {
                            "stream_uid": "",
                            "value": ""
                        }
                    ],
                    "mitre_attacks": [
                        {
                            "attack_id": "",
                            "informative_identifiers": [],
                            "malicious_identifiers": [],
                            "suspicious_identifiers": [],
                            "tactic": "",
                            "technique": ""
                        }
                    ],
                    "packer": "",
                    "pcap_report_artifact_id": "",
                    "processes": [
                        {
                            "command_line": "",
                            "file_accesses": [
                                {
                                    "mask": "",
                                    "path": "",
                                    "type": ""
                                }
                            ],
                            "handles": [
                                {
                                    "id": "",
                                    "path": "",
                                    "type": ""
                                }
                            ],
                            "icon_artifact_id": "",
                            "mutants": [],
                            "name": "",
                            "normalized_path": "",
                            "parent_uid": "",
                            "pid": "",
                            "process_flags": [
                                {
                                    "data": "",
                                    "name": ""
                                }
                            ],
                            "registry": [
                                {
                                    "key": "",
                                    "operation": "",
                                    "path": "",
                                    "status": "",
                                    "status_human_readable": "",
                                    "value": ""
                                }
                            ],
                            "script_calls": [
                                {
                                    "cls_id": "",
                                    "dispatch_id": "",
                                    "matched_malicious_signatures": [],
                                    "parameters": [
                                        {
                                            "argument_number": "",
                                            "comment": "",
                                            "meaning": "",
                                            "name": "",
                                            "value": ""
                                        }
                                    ],
                                    "result": "",
                                    "status": ""
                                }
                            ],
                            "sha256": "",
                            "streams": [
                                {
                                    "executed": true,
                                    "file_name": "",
                                    "human_keywords": "",
                                    "instructions_artifact_id": "",
                                    "matched_signatures": [
                                        {
                                            "id": "",
                                            "value": ""
                                        }
                                    ],
                                    "uid": ""
                                }
                            ],
                            "uid": ""
                        }
                    ],
                    "sample_flags": [],
                    "screenshots_artifact_ids": [],
                    "sha256": "",
                    "signatures": [
                        {
                            "attack_id": "",
                            "category": "",
                            "description": "",
                            "identifier": "",
                            "name": "",
                            "origin": "",
                            "relevance": "",
                            "threat_level": "",
                            "threat_level_human": "",
                            "type": ""
                        }
                    ],
                    "submission_type": "",
                    "submit_name": "",
                    "submit_url": "",
                    "suricata_alerts": [
                        {
                            "category": "",
                            "description": "",
                            "destination_ip": "",
                            "destination_port": "",
                            "protocol": "",
                            "sid": ""
                        }
                    ],
                    "target_url": "",
                    "threat_score": "",
                    "verdict": "",
                    "version_info": [
                        {
                            "id": "",
                            "value": ""
                        }
                    ],
                    "windows_version_bitness": "",
                    "windows_version_edition": "",
                    "windows_version_name": "",
                    "windows_version_service_pack": "",
                    "windows_version_version": ""
                }
            ],
            "tags": [],
            "user_id": "",
            "user_name": "",
            "user_tags": [],
            "user_uuid": "",
            "verdict": ""
        }
    ],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "pagination": {
            "limit": "",
            "offset": "",
            "total": ""
        },
        "powered_by": "",
        "query_time": "",
        "trace_id": "",
        "writes": {
            "resources_affected": ""
        }
    }
}

operation: Get Report Summary

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [
        {
            "cid": "",
            "created_timestamp": "",
            "id": "",
            "intel": [
                {
                    "actors": [
                        {
                            "id": "",
                            "name": "",
                            "slug": ""
                        }
                    ]
                }
            ],
            "ioc_report_broad_csv_artifact_id": "",
            "ioc_report_broad_json_artifact_id": "",
            "ioc_report_broad_maec_artifact_id": "",
            "ioc_report_broad_stix_artifact_id": "",
            "ioc_report_strict_csv_artifact_id": "",
            "ioc_report_strict_json_artifact_id": "",
            "ioc_report_strict_maec_artifact_id": "",
            "ioc_report_strict_stix_artifact_id": "",
            "origin": "",
            "sandbox": [
                {
                    "classification_tags": [],
                    "environment_description": "",
                    "environment_id": "",
                    "error_message": "",
                    "error_origin": "",
                    "error_type": "",
                    "file_type": "",
                    "incidents": [
                        {
                            "details": [],
                            "name": ""
                        }
                    ],
                    "sample_flags": [],
                    "sha256": "",
                    "submission_type": "",
                    "submit_name": "",
                    "submit_url": "",
                    "threat_score": "",
                    "verdict": ""
                }
            ],
            "tags": [],
            "user_id": "",
            "user_name": "",
            "user_tags": [],
            "verdict": ""
        }
    ],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "pagination": {
            "limit": "",
            "offset": "",
            "total": ""
        },
        "powered_by": "",
        "query_time": "",
        "trace_id": "",
        "writes": {
            "resources_affected": ""
        }
    }
}

operation: Get Analysis Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [
        {
            "cid": "",
            "created_timestamp": "",
            "id": "",
            "origin": "",
            "sandbox": [
                {
                    "action_script": "",
                    "command_line": "",
                    "document_password": "",
                    "enable_tor": "",
                    "environment_id": "",
                    "sha256": "",
                    "submit_name": "",
                    "system_date": "",
                    "system_time": "",
                    "url": ""
                }
            ],
            "state": "",
            "user_id": "",
            "user_name": "",
            "user_tags": [],
            "user_uuid": ""
        }
    ],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "pagination": {
            "limit": "",
            "offset": "",
            "total": ""
        },
        "powered_by": "",
        "query_time": "",
        "trace_id": "",
        "writes": {
            "resources_affected": ""
        }
    }
}

operation: Search Reports

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "pagination": {
            "limit": "",
            "offset": "",
            "total": ""
        },
        "powered_by": "",
        "query_time": "",
        "trace_id": "",
        "writes": {
            "resources_affected": ""
        }
    }
}

operation: Search Submission ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "pagination": {
            "limit": "",
            "offset": "",
            "total": ""
        },
        "powered_by": "",
        "query_time": "",
        "trace_id": "",
        "writes": {
            "resources_affected": ""
        }
    }
}

operation: Submit URL

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resources": [
        {
            "cid": "",
            "created_timestamp": "",
            "id": "",
            "origin": "",
            "sandbox": [
                {
                    "action_script": "",
                    "command_line": "",
                    "document_password": "",
                    "enable_tor": true,
                    "environment_id": "",
                    "sha256": "",
                    "submit_name": "",
                    "system_date": "",
                    "system_time": "",
                    "url": ""
                }
            ],
            "state": "",
            "user_id": "",
            "user_name": "",
            "user_tags": [],
            "user_uuid": ""
        }
    ],
    "errors": [
        {
            "code": "",
            "id": "",
            "message": ""
        }
    ],
    "meta": {
        "MsaMetaInfo": {
            "pagination": {
                "limit": "",
                "offset": "",
                "total": ""
            },
            "powered_by": "",
            "query_time": "",
            "trace_id": "",
            "writes": {
                "resources_affected": ""
            }
        },
        "quota": {
            "in_progress": "",
            "total": "",
            "used": ""
        }
    }
}

Included playbooks

The Sample - CrowdStrike Falcon X - 1.0.0 playbook collection comes bundled with the CrowdStrike Falcon X connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the CrowdStrike Falcon X connector.

• Get Analysis Status
• Get Full Report
• Get Report Summary
• Search Reports
• Search Submission ID
• Submit URL
• Submit Uploaded File
• Upload File

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.