Skip to content

Migrate CrowdStrike Falcon Endpoint Protection (3.4.4) to Defender XDR Custom Detections #15364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Alon Karmona (alon-karmona1) wants to merge 1 commit into from
Closed

Migrate CrowdStrike Falcon Endpoint Protection (3.4.4) to Defender XDR Custom Detections #15364

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 60 additions & 0 deletions ...ike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,66 @@ relevantTechniques:
- T1489
- T1562
query: |
let CrowdStrikeFalconEventStream = () {
CommonSecurityLog
| where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost"
| extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1),
DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2),
DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3)
// Additional Extensions
| extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions),
Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions),
Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions),
PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions),
SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))),
SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions)))
| extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType),
Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome),
Technique = coalesce(column_ifexists("Reason",""),Technique)
// Device Custom Number Values
| extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")),
ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")),
Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint(""))
| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3
// Device Custom Date Values
| extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")),
ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")),
DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")),
NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")),
DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")),
HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")),
HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime(""))
| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2
// Device Custom String Values
| extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""),
WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""),
QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""),
ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""),
AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""),
WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""),
AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""),
QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""),
ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""),
CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""),
FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "")
| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6
// Data Field Normalization
| project-rename DstHostName = DestinationHostName,
DstNtDomain = DestinationNTDomain,
DstUserName = DestinationUserName,
DstIpAddr = DestinationTranslatedAddress,
SrcMacAddr = SourceMACAddress,
SrcIpAddr = SourceIP
| extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType),
ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),
SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink),
Severity = case(LogSeverity == 1, "Informational",
LogSeverity == 2, "Low",
LogSeverity == 3, "Medium",
LogSeverity == 4, "High",
LogSeverity == 5, "Critical",
LogSeverity)
};
let timeframe = 1h;
let threshold = 15; // update threshold value based on organization's preference
let NotableEvents = CrowdStrikeFalconEventStream
Expand Down
60 changes: 60 additions & 0 deletions ...ions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,66 @@ relevantTechniques:
- T1204.002
- T1499
query: |
let CrowdStrikeFalconEventStream = () {
CommonSecurityLog
| where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost"
| extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1),
DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2),
DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3)
// Additional Extensions
| extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions),
Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions),
Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions),
PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions),
SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))),
SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions)))
| extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType),
Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome),
Technique = coalesce(column_ifexists("Reason",""),Technique)
// Device Custom Number Values
| extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")),
ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")),
Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint(""))
| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3
// Device Custom Date Values
| extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")),
ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")),
DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")),
NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")),
DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")),
HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")),
HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime(""))
| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2
// Device Custom String Values
| extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""),
WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""),
QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""),
ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""),
AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""),
WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""),
AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""),
QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""),
ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""),
CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""),
FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "")
| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6
// Data Field Normalization
| project-rename DstHostName = DestinationHostName,
DstNtDomain = DestinationNTDomain,
DstUserName = DestinationUserName,
DstIpAddr = DestinationTranslatedAddress,
SrcMacAddr = SourceMACAddress,
SrcIpAddr = SourceIP
| extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType),
ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),
SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink),
Severity = case(LogSeverity == 1, "Informational",
LogSeverity == 2, "Low",
LogSeverity == 3, "Medium",
LogSeverity == 4, "High",
LogSeverity == 5, "Critical",
LogSeverity)
};
let timeframe = 1h;
CrowdStrikeFalconEventStream
| where TimeGenerated > ago(timeframe)
Expand Down
9 changes: 7 additions & 2 deletions Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,13 @@
"azuresentinel.azure-sentinel-solution-commoneventformat"
],
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CrowdStrike Falcon Endpoint Protection",
"Version": "3.4.3",
"Metadata": "SolutionMetadata.json",
"TemplateSpec": true,
"Is1Pconnector": false
"Is1Pconnector": false,
"XDR Workbooks": [],
"XDR Detections": [
"XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml",
"XDR Detections/CriticalSeverityDetection.yaml"
],
"Version": "3.4.4"
}
Binary file added Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.4.4.zip
View file
Open in desktop
Binary file not shown.
58 changes: 56 additions & 2 deletions Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/Logo/crowdstrike.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities. \n\nThis solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.\n\n**Data Connectors:** 4, **Parsers:** 4, **Workbooks:** 1, **Analytic Rules:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/Logo/crowdstrike.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities. \n\nThis solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.\n\n**Data Connectors:** 4, **Parsers:** 4, **Workbooks:** 1, **Analytic Rules:** 2, **XDR Detections:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
Expand Down Expand Up @@ -51,6 +51,54 @@
}
],
"steps": [
{
"name": "contentSelection",
"label": "Content selection",
"elements": [
{
"name": "DeployAnalyticsRule",
"type": "Microsoft.Common.CheckBox",
"label": "DeployAnalyticsRule",
"defaultValue": true,
"toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
},
{
"name": "DeployPlaybook",
"type": "Microsoft.Common.CheckBox",
"label": "DeployPlaybook",
"defaultValue": true,
"toolTip": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve."
},
{
"name": "DeployWorkbook",
"type": "Microsoft.Common.CheckBox",
"label": "DeployWorkbook",
"defaultValue": true,
"toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
},
{
"name": "DeployDataConnector",
"type": "Microsoft.Common.CheckBox",
"label": "DeployDataConnector",
"defaultValue": true,
"toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
},
{
"name": "DeployCustomDetection",
"type": "Microsoft.Common.CheckBox",
"label": "DeployCustomDetection",
"defaultValue": false,
"toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch."
},
{
"name": "DeployParser",
"type": "Microsoft.Common.CheckBox",
"label": "DeployParser",
"defaultValue": true,
"toolTip": "Deploy the parsers and their registrations carried by this solution."
}
]
},
{
"name": "dataconnectors",
"label": "Data Connectors",
Expand Down Expand Up @@ -236,7 +284,13 @@
"outputs": {
"workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
"location": "[location()]",
"workspace": "[basics('workspace')]"
"workspace": "[basics('workspace')]",
"DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]",
"DeployPlaybook": "[steps('contentSelection').DeployPlaybook]",
"DeployWorkbook": "[steps('contentSelection').DeployWorkbook]",
"DeployDataConnector": "[steps('contentSelection').DeployDataConnector]",
"DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]",
"DeployParser": "[steps('contentSelection').DeployParser]"
}
}
}
Loading