feat(crowdstrike): bundle exhaustive OCSF mapper for search_detections
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -1,8 +1,8 @@
|
|||||||
id: crowdstrike
|
id: crowdstrike
|
||||||
name: CrowdStrike Falcon
|
name: CrowdStrike Falcon
|
||||||
version: 1.1.1
|
version: 1.2.0
|
||||||
description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
|
description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
|
||||||
changelog: "1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
|
changelog: "1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
|
||||||
category: endpoint
|
category: endpoint
|
||||||
|
|
||||||
# Per-instance configuration. Scripts obtain an OAuth2 bearer token from
|
# Per-instance configuration. Scripts obtain an OAuth2 bearer token from
|
||||||
|
|||||||
@@ -0,0 +1,58 @@
|
|||||||
|
name: "CrowdStrike Falcon Alerts → OCSF"
|
||||||
|
description: "Exhaustive map of a CrowdStrike Falcon unified alert (alerts/entities/alerts/v2, results_path = resources) to OCSF. Triggering process = actor (actor.*); detected file = subject (file.*); MITRE under attacks.*."
|
||||||
|
field_mappings:
|
||||||
|
title: "name"
|
||||||
|
severity: "severity_name = 'Critical' ? 5 : (severity_name = 'High' ? 4 : (severity_name = 'Medium' ? 3 : 2))"
|
||||||
|
description: "description"
|
||||||
|
# results_path = resources; source_path is JSONata over ONE alert object.
|
||||||
|
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
|
||||||
|
ocsf:
|
||||||
|
# ── Endpoint / device ─────────────────────────────────────────────
|
||||||
|
- { source_path: "device.hostname", ocsf_field: "src_endpoint.hostname" }
|
||||||
|
- { source_path: "device.machine_domain", ocsf_field: "src_endpoint.domain" }
|
||||||
|
- { source_path: "device.external_ip", ocsf_field: "src_endpoint.ip" }
|
||||||
|
- { source_path: "device.local_ip", ocsf_field: "device.ip" }
|
||||||
|
- { source_path: "device.os_version", ocsf_field: "src_endpoint.os.name" }
|
||||||
|
- { source_path: "device.platform_name", ocsf_field: "src_endpoint.os.type" }
|
||||||
|
- { source_path: "device.mac_address", ocsf_field: "src_endpoint.mac" }
|
||||||
|
- { source_path: "device.device_id", ocsf_field: "device.uid" }
|
||||||
|
- { source_path: "device.agent_version", ocsf_field: "metadata.product.version" }
|
||||||
|
# ── Finding / analytic ────────────────────────────────────────────
|
||||||
|
- { source_path: "composite_id", ocsf_field: "finding_info.uid" }
|
||||||
|
- { source_path: "name", ocsf_field: "finding_info.title" }
|
||||||
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
||||||
|
- { source_path: "created_timestamp", ocsf_field: "finding_info.created_time" }
|
||||||
|
- { source_path: "updated_timestamp", ocsf_field: "finding_info.modified_time" }
|
||||||
|
- { source_path: "type", ocsf_field: "finding_info.analytic.type" }
|
||||||
|
- { source_path: "pattern_id", ocsf_field: "finding_info.analytic.uid" }
|
||||||
|
- { source_path: "confidence", ocsf_field: "confidence" }
|
||||||
|
- { source_path: "status", ocsf_field: "status" }
|
||||||
|
- { source_path: "pattern_disposition_description", ocsf_field: "status_detail" }
|
||||||
|
# ── MITRE ATT&CK ──────────────────────────────────────────────────
|
||||||
|
- { source_path: "tactic", ocsf_field: "attacks.tactic.name" }
|
||||||
|
- { source_path: "tactic_id", ocsf_field: "attacks.tactic.uid" }
|
||||||
|
- { source_path: "technique", ocsf_field: "attacks.technique.name" }
|
||||||
|
- { source_path: "technique_id", ocsf_field: "attacks.technique.uid" }
|
||||||
|
# ── Triggering process — the actor ────────────────────────────────
|
||||||
|
- { source_path: "filename", ocsf_field: "actor.process.name" }
|
||||||
|
- { source_path: "cmdline", ocsf_field: "actor.process.cmd_line" }
|
||||||
|
- { source_path: "process_id", ocsf_field: "actor.process.pid" }
|
||||||
|
- { source_path: "filepath", ocsf_field: "actor.process.file.path" }
|
||||||
|
- { source_path: "sha256", ocsf_field: "actor.process.file.hashes.sha256" }
|
||||||
|
- { source_path: "md5", ocsf_field: "actor.process.file.hashes.md5" }
|
||||||
|
- { source_path: "user_name", ocsf_field: "actor.user.name" }
|
||||||
|
- { source_path: "user_id", ocsf_field: "actor.user.uid" }
|
||||||
|
- { source_path: "logon_domain", ocsf_field: "actor.user.domain" }
|
||||||
|
# ── Parent process ────────────────────────────────────────────────
|
||||||
|
- { source_path: "parent_details.filename", ocsf_field: "actor.process.parent_process.name" }
|
||||||
|
- { source_path: "parent_details.cmdline", ocsf_field: "actor.process.parent_process.cmd_line" }
|
||||||
|
- { source_path: "parent_details.process_id", ocsf_field: "actor.process.parent_process.pid" }
|
||||||
|
# ── Detected file — the subject ───────────────────────────────────
|
||||||
|
- { source_path: "filename", ocsf_field: "file.name" }
|
||||||
|
- { source_path: "filepath", ocsf_field: "file.path" }
|
||||||
|
- { source_path: "sha256", ocsf_field: "file.hashes.sha256" }
|
||||||
|
- { source_path: "md5", ocsf_field: "file.hashes.md5" }
|
||||||
|
# ── IOC / observable ──────────────────────────────────────────────
|
||||||
|
- { source_path: "ioc_value", ocsf_field: "observables.value" }
|
||||||
|
- { source_path: "ioc_type", ocsf_field: "observables.type" }
|
||||||
|
- { source_path: "ioc_description", ocsf_field: "observables.name" }
|
||||||
Reference in New Issue
Block a user