--- title: "CrowdStrike Intelligence collector" canonical: "https://docs.devo.com/space/latest/94655862/CrowdStrike%20Intelligence%20collector" format: markdown --- > Macro (toc) ## Purpose Use this collector to get **intelligence** about attacks from CrowdStrike. It should be used with the [CrowdStrike Falcon Data Replicator SQS collector](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1097728109), which replicates endpoint logs to Devo. In addition to these collectors, custom data can be sent from Crowdstrike Falcon to Devo using a [webhook](https://marketplace.crowdstrike.com/listings/webhook) and Devo’s [HTTP endpoint](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658823). An analyst wants to create an alert that triggers when there is a brute force attack on Active Directory. Using this collector, the “Password brute force attack (Active Directory)” event in CrowdStrike will trigger the alert so the analyst can determine if the attack was successful using a separate log of successful logins. The analyst will disable compromised accounts, preventing the brute force attacker from exfiltrating data. An analyst wants to create an alert that will trigger when an endpoint is infected by a rootkit. Using this collector, the “Attempt to tamper with Falcon sensor” event in CrowdStrike will trigger an alert indicating use of Windows Remote Management to prevent CrowdStrike from sensing subsequent actions. The analyst will isolate the endpoint to prevent it from gathering users' passwords. ## Example tables | **Table** | **Description** | | --- | --- | | [edr.crowdstrike](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94662338).falconstreaming.* | Data from different CrowdStrike APIs | | edr.crowdstrike.falconstreaming.detection_summary | Threat intelligence relating to processes and users. | | edr.crowdstrike.falconstreaming.alert | Threat intelligence relating to files. | | edr.crowdstrike.falconstreaming.customer_ioc | Indicators of compromise identified by CrowdStrike, such as domain names, IP addresses, and file names. Includes the ID of the compromised endpoint. | | edr.crowdstrike.falconstreaming.incidents | Identify the objective of an attack. | | edr.crowdstrike.falconstreaming.scheduled_report_notification | Monitor scheduled reports of vulnerabilities to ensure report SLA compliance. | | edr.crowdstrike.falcon_filevantage.change | Relate file operations to users, machines, and programs to identify ransomware and exfiltration. Includes prevalence intelligence. | | [edr.all.threats](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126148) | Endpoint threats, including edr.crowdstrike.falconstreaming.detection_summary. | | [firewall.all.traffic](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126157) | Firewall activity, including edr.crowdstrike.falconstreaming.firewall_match. | ## Authorize It 1. Log in to the CrowdStrike web app. 2. Open API clients and keys. 3. Create an API client. 4. Add a name and description. 5. According to CrowdStrike, “The scopes you see when creating an API client are determined by your subscribed products and the cloud where your account is hosted.” Enable “Read” for these scopes, if available: 1. Alerts 2. Event streams 3. FileVantage 4. Hosts 5. Incidents 6. Indicators 7. Vulnerabilities 6. Copy the Client ID, Secret, and Base URL. The information can only be accessed once. ## Run It A URL, client ID, and secret are required. The [URL CrowdStrike will provide you is typically](https://developer.crowdstrike.com/docs/openapi/) one of these: - [https://api.crowdstrike.com](https://api.crowdstrike.com) - [https://api.eu-1.crowdstrike.com](https://api.eu-1.crowdstrike.com) - [https://api.us-2.crowdstrike.com](https://api.us-2.crowdstrike.com) - [https://api.laggar.gcw.crowdstrike.com](https://api.laggar.gcw.crowdstrike.com) - [https://api.us-gov-2.crowdstrike.mil](https://api.us-gov-2.crowdstrike.mil) The client ID is a hexadecimal number. The secret is 40 letters and numbers. In the **Cloud Collector App**, [create a CrowdStrike API Resources](https://docs.devo.com/space/latest/409305131/Catalog#Create-an-instance) instance using this parameters template, replacing the values enclosed in `< >`. The `id` must be a unique five digit number. ``` { "inputs": { "crowdstrike": { "id": "", "credentials": { "client_id": "", "secret_key": "" }, "enabled": true, "override_api_base_url": "", "services": { "estream": {}, "vulnerabilities": { "start_timestamp_in_epoch_seconds": 1740000000 }, "filevantage": { "start_timestamp_in_epoch_seconds": 1740000000 }, "alerts": { "start_timestamp_in_epoch_seconds": 1740000000 }, "indicators": { "start_timestamp_in_epoch_seconds": 1740000000 }, "behaviors": { "start_timestamp_in_epoch_seconds": 1740000000 }, "hosts": { "start_timestamp_in_epoch_seconds": 1740000000 }, "incidents": { "start_timestamp_in_epoch_seconds": 1740000000 } } } } } ``` ![image-20250310-170109.png](media://3ff94db1-4471-442c-b633-fe09100487ad) ## Secure It ### Using the Devo Exchange Use [EDR](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#THREATSYS%2FEDR), file discovery, and [firewall](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#NETWORK%2FFIREWALL) queries from the library. ### Blocked Exploit An analyst wants to identify users associated with exploit attempts. These users should be evaluated to determine if they are compromised service accounts, users who need to be trained to resist social engineering attacks, or malicious individuals. ``` from edr.crowdstrike.falconstreaming.detection_summary where eq(DetectName,"Blocked Exploit") group by DetectDescription,UserName select collectdistinct(ComputerName) ``` ### Theft An analyst wants to identify user accounts that are stealing sensitive information. If hashed passwords are stolen, it may be appropriate to rotate those passwords. If permissions information such as the registry hive has been stolen, check privileged accounts for signs of attempted lateral movement by the attacker. ``` from edr.crowdstrike.falconstreaming.detection_summary where eq(DetectName,"Credential Theft") or eq(DetectName,"Data Theft") group by DetectDescription,UserName ``` ### Ransomware An analyst wants to identify computers infected with ransomware. This list can be used to speed restoration of backups, reducing downtime. ``` from edr.crowdstrike.falconstreaming.detection_summary where eq(DetectName,"Ransomware") group by DetectDescription,ComputerName ``` ### Firewall An analyst wants to check if a compromised host is attempting to make connections which are not allowed by the firewall. Generate a list of rules and commands which are triggering firewall rules. The commands should be evaluated to determine if they are malicious. ``` from edr.crowdstrike.falconstreaming.firewall_match where eq(hostName,"example") group by hostName, policyName, ruleName, commandLine ``` ### Rootkit An analyst wants to identify machines infected with rootkits. Attempts to tamper with Falcon may indicate a rootkit infection. ``` from edr.crowdstrike.falconstreaming.detection_summary where weakhas(DetectDescription,"tamper"), has(DetectDescription,"Falcon") group by DetectDescription, ComputerName, CommandLine ``` ### Brute force attack An analyst wants to identify accounts that have experienced brute force attacks. Successful logins recorded in `auth.all` after a brute force attack may indicate that the attack has succeeded. ``` from edr.crowdstrike.falconstreaming.identity_protection where toktains(incidentType,"brute force") group by incidentType, userName ``` ## Devo Collector Features | **Feature** | **Details** | | --- | --- | | Allow parallel downloading (multipod) | - `Not allowed` | | Running environments | - `Collector Server` | | Populated Devo events | - `Table` |