CrowdStrike Falcon

Endpoint security is at the frontline to protect against malicious cybersecurity threats. It represents one of the first places organizations look to secure their enterprise networks.
As the volume and sophistication of cybersecurity threats have increased, so has the need for more advanced endpoint security solutions.
CrowdStrike Falcon is one of the leaders in the Endpoint Protection Platform (EPP) market, and the CrowdStrike Falcon content pack provides a holistic solution for protecting enterprise endpoints and servers from malicious attacks that can seriously impact your organization.
This pack is designed to quickly detect, analyze, block, and contain malicious attacks in progress. It also gives administrators visibility into advanced threats to speed detection and remediation response times.

What Does This Pack Do?

Mirrors incidents between Cortex XSOAR incidents and CrowdStrike Falcon incidents or detections
Provides real-time response features
Assesses vulnerability
Contains endpoints (isolation/unisolation)
Removes duplicate incidents
Eliminates false positive incidents
Enriches incidents

Before You Start

Make sure you have the following content packs:

Base
Common Scripts
Common Types

Pack Configurations

To get up and running with this pack, you must get an API client ID and secret from CrowdStrike support: support@crowdstrike.com.

Name	Description
ConvertResourceAttributesToTable	This script is used to convert CrowdStrike IOM resource attributes to a table.
ReadNetstatFile	Load and return the processes file (generated from the cs-falcon-rtr-list-network-stats command) content.
TransformIndicatorToCSFalconIOC	Transform a XSOAR indicator into a Crowd Strike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CS Falcon format. This JSON can be used as the input for the cs-falcon-batch-upload-custom-ioc command.
ConvertUserIdentityToTable	This script is used to convert CrowdStrike IOA user identity response elements to a table.
ReadProcessesFile	Load and return the processes file (generated from the cs-falcon-rtr-list-processes command) content.
ConvertResponseElementsToTable	This script is used to convert CrowdStrike IOA response elements to a table.
ConvertRequestParametersToTable	This script is used to convert CrowdStrike IOA request parameters to a table.
ConvertEnrichmentsToTable	This script is used to convert CrowdStrike IOA enrichments response elements to a table.

Name

Description

ConvertResourceAttributesToTable

This script is used to convert CrowdStrike IOM resource attributes to a table.

ReadNetstatFile

Load and return the processes file (generated from the cs-falcon-rtr-list-network-stats command) content.

TransformIndicatorToCSFalconIOC

Transform a XSOAR indicator into a Crowd Strike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CS Falcon format. This JSON can be used as the input for the cs-falcon-batch-upload-custom-ioc command.

ConvertUserIdentityToTable

This script is used to convert CrowdStrike IOA user identity response elements to a table.

ReadProcessesFile

Load and return the processes file (generated from the cs-falcon-rtr-list-processes command) content.

ConvertResponseElementsToTable

This script is used to convert CrowdStrike IOA response elements to a table.

ConvertRequestParametersToTable

This script is used to convert CrowdStrike IOA request parameters to a table.

ConvertEnrichmentsToTable

This script is used to convert CrowdStrike IOA enrichments response elements to a table.

Name	Description
CrowdStrike Falcon Incident Classifier	CrowdStrike Falcon Incident Classifier
Legacy CrowdStrike Falcon-Mapper	CrowdStrike Falcon Mapper for incidents and detections - for legacy version of CrowdStrike
CrowdStrike Falcon - Outgoing Mapper	CrowdStrike Falcon mirror out mapper.
CrowdStrike Falcon Mapper	CrowdStrike Falcon Mapper for incidents and detections

Name

Description

CrowdStrike Falcon Incident Classifier

Legacy CrowdStrike Falcon-Mapper

CrowdStrike Falcon Mapper for incidents and detections - for legacy version of CrowdStrike

CrowdStrike Falcon - Outgoing Mapper

CrowdStrike Falcon mirror out mapper.

CrowdStrike Falcon Mapper

CrowdStrike Falcon Mapper for incidents and detections

Name	Description
CrowdStrike Falcon Scan Id
CrowdStrike Falcon Mobile Manufacturer
CrowdStrike Falcon System Product Name
CrowdStrike Falcon Firmware Build Fingerprint
CrowdStrike Falcon Enrichments
CrowdStrike Falcon User Identity
CrowdStrike Falcon Scan Name
Behaviour Tactic	Behaviour Tactic
CrowdStrike Falcon Request Parameters
CrowdStrike Falcon User Agent
CrowdStrike Falcon Product Type Description
CrowdStrike Falcon Vertex ID
CrowdStrike Falcon Behaviour Pattern Disposition Details
Behaviour Objective	Behaviour Objective
CrowdStrike Falcon Resource Attributes
CrowdStrike Falcon Response Elements
CrowdStrike Falcon Firmware Build Time
CrowdStrike Falcon Mobile platform version
CrowdStrike Falcon System Manufacturer
CrowdStrike Falcon Service Type
CrowdStrike Falcon Security patch level
CrowdStrike Falcon Detection Type
CrowdStrike Falcon Crawled Timestamp
Behaviour Scenario	Behaviour Scenario
CrowdStrike Falcon Pattern ID
CrowdStrike Falcon Mobile Product
CrowdStrike Falcon Platform Name
CrowdStrike Falcon Vertex Type

Name

Description

CrowdStrike Falcon Scan Id

CrowdStrike Falcon Mobile Manufacturer

CrowdStrike Falcon System Product Name

CrowdStrike Falcon Firmware Build Fingerprint

CrowdStrike Falcon Enrichments

CrowdStrike Falcon User Identity

CrowdStrike Falcon Scan Name

Behaviour Tactic

CrowdStrike Falcon Request Parameters

CrowdStrike Falcon User Agent

CrowdStrike Falcon Product Type Description

CrowdStrike Falcon Vertex ID

CrowdStrike Falcon Behaviour Pattern Disposition Details

Behaviour Objective

CrowdStrike Falcon Resource Attributes

CrowdStrike Falcon Response Elements

CrowdStrike Falcon Firmware Build Time

CrowdStrike Falcon Mobile platform version

CrowdStrike Falcon System Manufacturer

CrowdStrike Falcon Service Type

CrowdStrike Falcon Security patch level

CrowdStrike Falcon Detection Type

CrowdStrike Falcon Crawled Timestamp

Behaviour Scenario

CrowdStrike Falcon Pattern ID

CrowdStrike Falcon Mobile Product

CrowdStrike Falcon Platform Name

CrowdStrike Falcon Vertex Type

Name	Description
CrowdStrike Falcon IOA Event
CrowdStrike Falcon Detection
CrowdStrike Falcon Mobile Detection
CrowdStrike Falcon IDP Detection
CrowdStrike Falcon Incident
CrowdStrike Falcon On-Demand Scans Detection
CrowdStrike Falcon IOM Event

Name

Description

CrowdStrike Falcon IOA Event

CrowdStrike Falcon Detection

CrowdStrike Falcon Mobile Detection

CrowdStrike Falcon IDP Detection

CrowdStrike Falcon Incident

CrowdStrike Falcon On-Demand Scans Detection

CrowdStrike Falcon IOM Event

Name	Description
CrowdStrike Falcon	The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.

Name

Description

CrowdStrike Falcon

The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.

Name	Description
CrowdStrike Falcon Layout

Name

Description

CrowdStrike Falcon Layout

Name	Description
CrowdStrike Falcon - Search Endpoints By Hash	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash.
CrowdStrike Falcon Malware - Incident Enrichment	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.
CrowdStrike Falcon - Get Detections by Incident	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables getting CrowdStrike Falcon detection details based on the CrowdStrike incident ID.
CrowdStrike Falcon - False Positive Incident Handling	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it.
CrowdStrike Falcon Malware - Investigation and Response	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike Falcon malware investigation, including: Extracting and displaying MITRE data from the EDR and sandboxes Deduplicating similar incidents Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox. Verifying the actions taken by the EDR Analyzing the command line Searching for relevant hashes in additional hosts in the organization Retrieving data about the host, including process list and network connections Performing containment and mitigation actions as part of handling false/true positives Setting the relevant layouts
CrowdStrike Falcon Malware - Verify Containment Actions	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook verifies and sets the policy actions applied by CrowdStrike Falcon.
CrowdStrike Falcon - True Positive Incident Handling	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it.
CrowdStrike Falcon - SIEM ingestion Get Incident Data	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles incident ingestion from a SIEM. The user provides the field for the incident ID or detection ID and the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type.
CrowdStrike Falcon - Block File	This playbook receives an MD5 or a SHA256 hash and adds it to the block list in CrowdStrike Falcon. The playbook uses the integration "CrowdStrike Falcon".
Crowdstrike Falcon - Isolate Endpoint	This playbook will auto isolate endpoints by the device ID that was provided in the playbook.
CrowdStrike Falcon - Retrieve File	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.
CrowdStrike Falcon - Get Endpoint Forensics Data	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.
Crowdstrike Falcon - Unisolate Endpoint	This playbook unisolates devices according to the device ID that is provided in the playbook input.

Name

Description

CrowdStrike Falcon - Search Endpoints By Hash

CrowdStrike Falcon Malware - Incident Enrichment

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.

CrowdStrike Falcon - Get Detections by Incident

CrowdStrike Falcon - False Positive Incident Handling

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook handles a CrowdStrike incident that was determined
to be a false positive by the analyst. Actions include unisolating the host, allowing
the indicator by the EDR, and tagging it.

CrowdStrike Falcon Malware - Investigation and Response

Extracting and displaying MITRE data from the EDR and sandboxes
Deduplicating similar incidents
Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.
Verifying the actions taken by the EDR
Analyzing the command line
Searching for relevant hashes in additional hosts in the organization
Retrieving data about the host, including process list and network connections
Performing containment and mitigation actions as part of handling false/true positives
Setting the relevant layouts

CrowdStrike Falcon Malware - Verify Containment Actions

CrowdStrike Falcon - True Positive Incident Handling

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it.

CrowdStrike Falcon - SIEM ingestion Get Incident Data

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook handles incident ingestion from a SIEM.
The user provides the field for the incident ID or detection ID and the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type.

CrowdStrike Falcon - Block File

This playbook receives an MD5 or a SHA256 hash and adds it to the block list in CrowdStrike Falcon.
The playbook uses the integration "CrowdStrike Falcon".

Crowdstrike Falcon - Isolate Endpoint

This playbook will auto isolate endpoints by the device ID that was provided in the playbook.

CrowdStrike Falcon - Retrieve File

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.

CrowdStrike Falcon - Get Endpoint Forensics Data

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.

Crowdstrike Falcon - Unisolate Endpoint

This playbook unisolates devices according to the device ID that is provided in the playbook input.

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Malware Investigation and Response	By: Cortex XSOAR

Pack Name	Pack By
Atlassian Jira	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Malware Investigation and Response	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

Certification	Certified	Read more
Supported By	Cortex
Created	September 9, 2020
Last Release	December 18, 2024

What Does This Pack Do?

Before You Start

Pack Configurations

Playbooks

CrowdStrike Falcon Malware - Investigation and Response

CrowdStrike Falcon Malware - Incident Enrichment

Playbooks

CrowdStrike Falcon - False Positive Incident Handling

CrowdStrike Falcon Malware - Investigation and Response

CrowdStrike Falcon - True Positive Incident Handling

CrowdStrike Falcon - SIEM ingestion Get Incident Data

CrowdStrike Falcon Malware - Incident Enrichment

Scripts

ConvertEnrichmentsToTable

ConvertResourceAttributesToTable

ReadProcessesFile

ReadNetstatFile

ConvertUserIdentityToTable

ConvertRequestParametersToTable

ConvertResponseElementsToTable

TransformIndicatorToCSFalconIOC

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Mappers

CrowdStrike Falcon Mapper

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Mappers

CrowdStrike Falcon Mapper

Playbooks

CrowdStrike Falcon Malware - Incident Enrichment

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Classifiers

CrowdStrike Falcon Incident Classifier

Incident Fields

Integrations

CrowdStrike Falcon

Mappers

New: Legacy CrowdStrike Falcon-Mapper

CrowdStrike Falcon Mapper

Integrations

CrowdStrike Falcon