diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml index 433f063bd93..f47d8febea9 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml @@ -19,6 +19,66 @@ relevantTechniques: - T1489 - T1562 query: | + let CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; let timeframe = 1h; let threshold = 15; // update threshold value based on organization's preference let NotableEvents = CrowdStrikeFalconEventStream diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml index 8a7958d6ef3..c231fdfad5a 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml @@ -19,6 +19,66 @@ relevantTechniques: - T1204.002 - T1499 query: | + let CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; let timeframe = 1h; CrowdStrikeFalconEventStream | where TimeGenerated > ago(timeframe) diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json index 2d4992526d2..41f6f4dae46 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json @@ -31,8 +31,13 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CrowdStrike Falcon Endpoint Protection", - "Version": "3.4.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, - "Is1Pconnector": false + "Is1Pconnector": false, + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml", + "XDR Detections/CriticalSeverityDetection.yaml" + ], + "Version": "3.4.4" } diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.4.4.zip b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.4.4.zip new file mode 100644 index 00000000000..3d8128d567d Binary files /dev/null and b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.4.4.zip differ diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json index 3eec680fd98..9e751feaa9d 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities. \n\nThis solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.\n\n**Data Connectors:** 4, **Parsers:** 4, **Workbooks:** 1, **Analytic Rules:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities. \n\nThis solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.\n\n**Data Connectors:** 4, **Parsers:** 4, **Workbooks:** 1, **Analytic Rules:** 2, **XDR Detections:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,54 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployPlaybook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployPlaybook", + "defaultValue": true, + "toolTip": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployDataConnector", + "type": "Microsoft.Common.CheckBox", + "label": "DeployDataConnector", + "defaultValue": true, + "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployParser", + "type": "Microsoft.Common.CheckBox", + "label": "DeployParser", + "defaultValue": true, + "toolTip": "Deploy the parsers and their registrations carried by this solution." + } + ] + }, { "name": "dataconnectors", "label": "Data Connectors", @@ -236,7 +284,13 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployPlaybook": "[steps('contentSelection').DeployPlaybook]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployParser": "[steps('contentSelection').DeployParser]" } } } diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json index d2732d1803f..2e756044beb 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json @@ -49,13 +49,55 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployPlaybook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "CrowdStrike Falcon Endpoint Protection", - "_solutionVersion": "3.4.3", + "_solutionVersion": "3.4.4", "solutionId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CrowdstrikeReplicatorv2", @@ -77,7 +119,7 @@ "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.4.3", + "dataConnectorCCPVersion": "3.4.4", "_dataConnectorContentIdConnectorDefinition3": "CrowdStrikeFalconS3CCPDefinition", "dataConnectorTemplateNameConnectorDefinition3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition3')))]", "_dataConnectorContentIdConnections3": "CrowdStrikeFalconS3CCPDefinitionConnections", @@ -175,7 +217,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.3", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -371,7 +413,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -401,7 +444,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", @@ -548,7 +592,8 @@ "id": "[variables('_uiConfigId1')]", "additionalRequirementBanner": "These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions alias **CrowdstrikeReplicator** in queries and workbooks [Follow steps to get this Kusto functions>](https://aka.ms/sentinel-crowdstrikereplicator-parser)." } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -559,7 +604,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.3", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -727,7 +772,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId2')]", "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -757,7 +803,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", @@ -879,7 +926,8 @@ ], "id": "[variables('_uiConfigId2')]" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1237,7 +1285,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]", @@ -10480,7 +10529,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]", @@ -10820,7 +10870,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]", @@ -10855,7 +10906,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -10980,7 +11032,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -11357,7 +11410,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition4')))]", @@ -15870,7 +15924,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition4'))]", @@ -16229,7 +16284,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition4')))]", @@ -16264,7 +16320,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17001,7 +17058,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17012,7 +17070,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeFalconEventStream Data Parser with template version 3.4.3", + "description": "CrowdStrikeFalconEventStream Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -17082,7 +17140,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "version": "[variables('parserObject1').parserVersion1]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17103,7 +17162,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17133,7 +17193,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17144,7 +17205,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdstrikeReplicator Data Parser with template version 3.4.3", + "description": "CrowdstrikeReplicator Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -17214,7 +17275,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '2.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '2.0.0')))]", "version": "[variables('parserObject2').parserVersion2]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17235,7 +17297,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17265,7 +17328,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17276,7 +17340,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeReplicatorV2 Data Parser with template version 3.4.3", + "description": "CrowdStrikeReplicatorV2 Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -17346,7 +17410,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", "version": "[variables('parserObject3').parserVersion3]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17367,7 +17432,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17397,7 +17463,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17408,7 +17475,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeApi Data Parser with template version 3.4.3", + "description": "CrowdStrikeApi Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -17478,7 +17545,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", "version": "[variables('parserObject4').parserVersion4]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17499,7 +17567,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17529,7 +17598,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17540,7 +17610,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeFalconEndpointProtection Workbook with template version 3.4.3", + "description": "CrowdStrikeFalconEndpointProtection Workbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -17617,7 +17687,8 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17628,7 +17699,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalOrHighSeverityDetectionsByUser_AnalyticalRules Analytics Rule with template version 3.4.3", + "description": "CriticalOrHighSeverityDetectionsByUser_AnalyticalRules Analytics Rule with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -17645,7 +17716,7 @@ "description": "Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.", "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", "enabled": false, - "query": "let timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity\n", + "query": "let CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -17656,10 +17727,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -17713,16 +17784,16 @@ } ], "customDetails": { - "FileName": "FileName", - "DstHostName": "DstHostName", "DstUserName": "DstUserName", - "FileHash": "FileHash", + "SrcIpAddr": "SrcIpAddr", "Total": "Total", - "SrcIpAddr": "SrcIpAddr" + "DstHostName": "DstHostName", + "FileHash": "FileHash", + "FileName": "FileName" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "CrowdStrike critical/high detections by user: {{DstUserName}}", - "alertDescriptionFormat": "User {{DstUserName}} generated {{Total}} critical/high detections from host {{DstHostName}}." + "alertDescriptionFormat": "User {{DstUserName}} generated {{Total}} critical/high detections from host {{DstHostName}}.", + "alertDisplayNameFormat": "CrowdStrike critical/high detections by user: {{DstUserName}}" } } }, @@ -17766,7 +17837,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17777,7 +17849,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalSeverityDetection_AnalyticalRules Analytics Rule with template version 3.4.3", + "description": "CriticalSeverityDetection_AnalyticalRules Analytics Rule with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -17794,7 +17866,7 @@ "description": "Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.", "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", "enabled": false, - "query": "let timeframe = 1h;\nCrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo\n", + "query": "let CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nCrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -17805,10 +17877,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -17865,19 +17937,19 @@ } ], "customDetails": { - "DetectionSourceIp": "SrcIpAddr", - "DetectionTechnique": "Technique", - "DetectionCount": "Total", - "DetectionUser": "DstUserName", - "DetectionActivity": "Activity", "DetectionFilePath": "FilePath", "DetectionMessage": "Message", + "DetectionSourceIp": "SrcIpAddr", "DetectionFileName": "FileName", - "DetectionHost": "DstHostName" + "DetectionCount": "Total", + "DetectionUser": "DstUserName", + "DetectionTechnique": "Technique", + "DetectionHost": "DstHostName", + "DetectionActivity": "Activity" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "CrowdStrike critical detection on {{DstHostName}}", - "alertDescriptionFormat": "CrowdStrike reported {{Total}} critical detection(s) on {{DstHostName}} for {{DstUserName}}." + "alertDescriptionFormat": "CrowdStrike reported {{Total}} critical detection(s) on {{DstHostName}} for {{DstUserName}}.", + "alertDisplayNameFormat": "CrowdStrike critical detection on {{DstHostName}}" } } }, @@ -17921,7 +17993,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17932,7 +18005,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike_Base Playbook with template version 3.4.3", + "description": "CrowdStrike_Base Playbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -18298,7 +18371,8 @@ "contentProductId": "[variables('_playbookcontentProductId1')]", "id": "[variables('_playbookcontentProductId1')]", "version": "[variables('playbookVersion1')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -18309,7 +18383,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Crowdstrike-EndpointEnrichment Playbook with template version 3.4.3", + "description": "Crowdstrike-EndpointEnrichment Playbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -19753,7 +19827,8 @@ "contentProductId": "[variables('_playbookcontentProductId2')]", "id": "[variables('_playbookcontentProductId2')]", "version": "[variables('playbookVersion2')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -19764,7 +19839,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Crowdstrike-ContainHost Playbook with template version 3.4.3", + "description": "Crowdstrike-ContainHost Playbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -20872,19 +20947,20 @@ "contentProductId": "[variables('_playbookcontentProductId3')]", "id": "[variables('_playbookcontentProductId3')]", "version": "[variables('playbookVersion3')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.4.3", + "version": "3.4.4", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "CrowdStrike Falcon Endpoint Protection", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n

This solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.

\n

Data Connectors: 4, Parsers: 4, Workbooks: 1, Analytic Rules: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n

This solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.

\n

Data Connectors: 4, Parsers: 4, Workbooks: 1, Analytic Rules: 2, XDR Detections: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -20981,6 +21057,16 @@ { "kind": "Solution", "contentId": "azuresentinel.azure-sentinel-solution-commoneventformat" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "version": "3.4.3" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "version": "3.4.3" } ] }, @@ -20996,6 +21082,447 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "CrowdStrikeFalconEndpointProtection-CD-xdr-4465ebde-b38-885b1f00", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c', 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = __xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "customDetails": { + "DstUserName": "DstUserName", + "SrcIpAddr": "SrcIpAddr", + "Total": "Total", + "DstHostName": "DstHostName", + "FileHash": "FileHash", + "FileName": "FileName" + }, + "tactics": [ + { + "techniques": [ + { + "technique": "T1489" + } + ], + "tactic": "Impact" + } + ], + "description": "'Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentVersion": "3.4.3" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-4465ebde-b381-45f7-ad08-7d818070a11c')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'CrowdStrikeFalconEndpointProtection-CD-xdr-4465ebde-b38-885b1f00')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c', 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = __xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "customDetails": { + "DstUserName": "DstUserName", + "SrcIpAddr": "SrcIpAddr", + "Total": "Total", + "DstHostName": "DstHostName", + "FileHash": "FileHash", + "FileName": "FileName" + }, + "tactics": [ + { + "techniques": [ + { + "technique": "T1489" + } + ], + "tactic": "Impact" + } + ], + "description": "'Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentVersion": "3.4.3" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentKind": "CustomDetection", + "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-4465ebde-b381-45f7-ad08-7d818070a11c','-','3.4.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-4465ebde-b381-45f7-ad08-7d818070a11c','-','3.4.3')))]", + "version": "3.4.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentVersion": "3.4.3", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "CrowdStrikeFalconEndpointProtection-CD-xdr-f7d298b2-726-b76cade2", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527', 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\n__xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "customDetails": { + "DetectionFilePath": "FilePath", + "DetectionMessage": "Message", + "DetectionSourceIp": "SrcIpAddr", + "DetectionFileName": "FileName", + "DetectionCount": "Total", + "DetectionUser": "DstUserName", + "DetectionTechnique": "Technique", + "DetectionHost": "DstHostName", + "DetectionActivity": "Activity" + }, + "tactics": [ + { + "techniques": [ + { + "subTechniques": [ + "T1204.002" + ], + "technique": "T1204" + } + ], + "tactic": "Execution" + } + ], + "description": "'Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentVersion": "3.4.3" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'CrowdStrikeFalconEndpointProtection-CD-xdr-f7d298b2-726-b76cade2')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527', 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\n__xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "customDetails": { + "DetectionFilePath": "FilePath", + "DetectionMessage": "Message", + "DetectionSourceIp": "SrcIpAddr", + "DetectionFileName": "FileName", + "DetectionCount": "Total", + "DetectionUser": "DstUserName", + "DetectionTechnique": "Technique", + "DetectionHost": "DstHostName", + "DetectionActivity": "Activity" + }, + "tactics": [ + { + "techniques": [ + { + "subTechniques": [ + "T1204.002" + ], + "technique": "T1204" + } + ], + "tactic": "Execution" + } + ], + "description": "'Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentVersion": "3.4.3" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentKind": "CustomDetection", + "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527','-','3.4.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527','-','3.4.3')))]", + "version": "3.4.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentVersion": "3.4.3", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-e73b7985-462c-4cc7-922e-ffa9e9254759-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json index 9af88146df7..154a0e63be1 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json @@ -42,5 +42,47 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployPlaybook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } } diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md b/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md index ebc686a9f50..7a498b68a8a 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------------------| +| 3.4.4 | 20-10-2026 | Added two disabled Defender XDR Custom Detections alongside the existing Microsoft Sentinel content. Defender Workbook drafts remain excluded pending review. | | 3.4.3 | 06-10-2026 | Updated the CrowdStrike API connector DCR naming and configuration, and added upgrade guidance for V2 tables. | | 3.4.2 | 25-09-2026 | Added the CrowdStrike API parser to the solution package | | 3.4.1 | 25-08-2026 | Fixed the broken **Deploy to Azure Gov** badge image across **Data Connector** and **Playbook** docs | diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json b/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json index 8bc1c36ed70..8d6b5c053d3 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json @@ -1,16 +1,23 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-crowdstrikefalconep", - "firstPublishDate": "2022-06-01", - "providers": ["Crowdstrike"], - "categories": { - "domains" : ["Security - Threat Protection","Security - Automation (SOAR)"], - "verticals": [] - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } -} \ No newline at end of file + "trackingId": "pid-e73b7985-462c-4cc7-922e-ffa9e9254759-partnercenter", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-crowdstrikefalconep", + "firstPublishDate": "2022-06-01", + "providers": [ + "Crowdstrike" + ], + "categories": { + "domains": [ + "Security - Threat Protection", + "Security - Automation (SOAR)" + ], + "verticals": [] + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "version": "3.4.4" +} diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml new file mode 100644 index 00000000000..b44761b0568 --- /dev/null +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml @@ -0,0 +1,258 @@ +schemaVersion: 1.0.0 +version: 3.4.3 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CefAma + dataTypes: + - CommonSecurityLog +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 4465ebde-b381-45f7-ad08-7d818070a11c + path: Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml + version: 1.0.6 + querySha256: 9f061790b0666ec4a90fcd70b7f58a388d595ce0a0228bd4f9e10dde1fee8259 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - Renamed local parser binding CrowdStrikeFalconEventStream to __xdr_inline_CrowdStrikeFalconEventStream to avoid a saved + parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Account mapping is incomplete and was removed + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' + - 'converter cannot map FileHash.Algorithm/Value: requires a query-proven constant SHA1 or SHA256 algorithm and an available + hash value column; MD5, unknown algorithms and linked file/process references are not inferred' + - customDetails 'DstUserName' column `DstUserName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DstHostName' column `DstHostName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'SrcIpAddr' column `SrcIpAddr` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'FileName' column `FileName` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'FileHash' column `FileHash` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'Total' column `Total` has an unproven output binding after a destructive projection; the explicit binding + is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - Account.FullName output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Host.FullName output column `HostCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Algorithm output column `FileHashAlgo` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Value output column `FileHashCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Impact + - DefenseEvasion + originalTechniques: + - T1489 + - T1562 + reviewScope: + sourceDocumentSha256: 1990e286c65398bc749a892d884adc3c0dd45f5be9aed222b1e880512a035fef + targetQuerySha256: 1d08b1e84675db413e5f94a1616c1c70d55b1467ba1ece2aef87659d3d06aa5d + reviewDecisions: + - reason: 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally + represented by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The + original value is also retained in customDetails when the query output binding is available; this assumption does + not prove entity parity' + decision: accepted + sourceDocumentSha256: 1990e286c65398bc749a892d884adc3c0dd45f5be9aed222b1e880512a035fef + targetQuerySha256: 1d08b1e84675db413e5f94a1616c1c70d55b1467ba1ece2aef87659d3d06aa5d + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: 1990e286c65398bc749a892d884adc3c0dd45f5be9aed222b1e880512a035fef + targetQuerySha256: 1d08b1e84675db413e5f94a1616c1c70d55b1467ba1ece2aef87659d3d06aa5d + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: FullName + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: Host + entityIndex: 2 + identifier: FullName + sourceColumn: HostCustomEntity + column: HostCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Algorithm + sourceColumn: FileHashAlgo + column: FileHashAlgo + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Value + sourceColumn: FileHashCustomEntity + column: FileHashCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' +properties: + id: xdr-4465ebde-b381-45f7-ad08-7d818070a11c + displayName: Common Event Format (CEF) via AMA - Critical or High Severity Detections by User + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; + let timeframe = 1h; + let threshold = 15; // update threshold value based on organization's preference + let NotableEvents = __xdr_inline_CrowdStrikeFalconEventStream + | where TimeGenerated > ago(timeframe) + | where EventType == "DetectionSummaryEvent" + | where Severity in ("Critical", "High") + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message + | where Total > threshold; + NotableEvents + | extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = "MD5" + | project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Common Event Format (CEF) via AMA - Critical or High Severity Detections by User + description: '''Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections + is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent + records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured + threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.''' + severity: high + entityMappings: + hosts: + - id: host1 + nameColumn: HostCustomEntity + ips: + - id: ip1 + addressColumn: IPCustomEntity + tactics: + - tactic: Impact + techniques: + - technique: T1489 + - tactic: DefenseEvasion + techniques: + - technique: T1562 + customDetails: + DstUserName: DstUserName + DstHostName: DstHostName + SrcIpAddr: SrcIpAddr + FileName: FileName + FileHash: FileHash + Total: Total diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalSeverityDetection.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalSeverityDetection.yaml new file mode 100644 index 00000000000..1d2a1c0806a --- /dev/null +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalSeverityDetection.yaml @@ -0,0 +1,272 @@ +schemaVersion: 1.0.0 +version: 3.4.3 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CefAma + dataTypes: + - CommonSecurityLog +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: f7d298b2-726c-42a5-bbac-0d7f9950f527 + path: Analytic Rules/CriticalSeverityDetection.yaml + version: 1.0.6 + querySha256: df60e1b6e01294f49a0e3bdde213f73c1e0ca67c31cef87f0526ca2d8cacc81b + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - Renamed local parser binding CrowdStrikeFalconEventStream to __xdr_inline_CrowdStrikeFalconEventStream to avoid a saved + parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Account mapping is incomplete and was removed + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' + - 'converter cannot map FileHash.Algorithm/Value: requires a query-proven constant SHA1 or SHA256 algorithm and an available + hash value column; MD5, unknown algorithms and linked file/process references are not inferred' + - customDetails 'DetectionCount' column `Total` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'DetectionMessage' column `Message` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionTechnique' column `Technique` has an unproven output binding after a destructive projection; + the explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionActivity' column `Activity` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionFileName' column `FileName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionFilePath' column `FilePath` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionHost' column `DstHostName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionUser' column `DstUserName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionSourceIp' column `SrcIpAddr` has an unproven output binding after a destructive projection; + the explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - Account.FullName output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Host.FullName output column `HostCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Algorithm output column `FileHashAlgo` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Value output column `FileHashCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Execution + - Impact + originalTechniques: + - T1204.002 + - T1499 + reviewScope: + sourceDocumentSha256: 235e775eca9f31958102b9d4bc46e169f10bafe753a0cc1b5d9fd99acfa2951b + targetQuerySha256: 9f6df47dcdf0931fa4803994a09c541143ae8a734b4abd1b8c0951d33607677b + reviewDecisions: + - reason: 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally + represented by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The + original value is also retained in customDetails when the query output binding is available; this assumption does + not prove entity parity' + decision: accepted + sourceDocumentSha256: 235e775eca9f31958102b9d4bc46e169f10bafe753a0cc1b5d9fd99acfa2951b + targetQuerySha256: 9f6df47dcdf0931fa4803994a09c541143ae8a734b4abd1b8c0951d33607677b + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: 235e775eca9f31958102b9d4bc46e169f10bafe753a0cc1b5d9fd99acfa2951b + targetQuerySha256: 9f6df47dcdf0931fa4803994a09c541143ae8a734b4abd1b8c0951d33607677b + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: FullName + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: Host + entityIndex: 2 + identifier: FullName + sourceColumn: HostCustomEntity + column: HostCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Algorithm + sourceColumn: FileHashAlgo + column: FileHashAlgo + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Value + sourceColumn: FileHashCustomEntity + column: FileHashCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' +properties: + id: xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527 + displayName: Common Event Format (CEF) via AMA - Critical Severity Detection + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; + let timeframe = 1h; + __xdr_inline_CrowdStrikeFalconEventStream + | where TimeGenerated > ago(timeframe) + | where EventType == "DetectionSummaryEvent" + | where Severity == "Critical" + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message + | extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = "MD5" + | project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Common Event Format (CEF) via AMA - Critical Severity Detection + description: '''Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. + The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes + detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident + for each matching result.''' + severity: high + entityMappings: + hosts: + - id: host1 + nameColumn: HostCustomEntity + ips: + - id: ip1 + addressColumn: IPCustomEntity + tactics: + - tactic: Execution + techniques: + - technique: T1204 + subTechniques: + - T1204.002 + - tactic: Impact + techniques: + - technique: T1499 + customDetails: + DetectionCount: Total + DetectionMessage: Message + DetectionTechnique: Technique + DetectionActivity: Activity + DetectionFileName: FileName + DetectionFilePath: FilePath + DetectionHost: DstHostName + DetectionUser: DstUserName + DetectionSourceIp: SrcIpAddr