CrowdStrike Falcon

Endpoint security is at the frontline to protect against malicious cybersecurity threats. It represents one of the first places organizations look to secure their enterprise networks.
As the volume and sophistication of cybersecurity threats have increased, so has the need for more advanced endpoint security solutions.
CrowdStrike Falcon is one of the leaders in the Endpoint Protection Platform (EPP) market, and the CrowdStrike Falcon content pack provides a holistic solution for protecting enterprise endpoints and servers from malicious attacks that can seriously impact your organization.
This pack is designed to quickly detect, analyze, block, and contain malicious attacks in progress. It also gives administrators visibility into advanced threats to speed detection and remediation response times.

What Does This Pack Do?

Mirrors incidents between Cortex XSOAR incidents and CrowdStrike Falcon incidents or detections
Provides real-time response features
Assesses vulnerability
Contains endpoints (isolation/unisolation)
Removes duplicate incidents
Eliminates false positive incidents
Enriches incidents

Before You Start

Make sure you have the following content packs:

Base
Common Scripts
Common Types

Pack Configurations

To get up and running with this pack, you must get an API client ID and secret from CrowdStrike support: support@crowdstrike.com.

Name	Description
ConvertEnrichmentsToTable	This script is used to convert CrowdStrike IOA enrichments response elements to a table.
ReadNetstatFile	Load and return the processes file (generated from the cs-falcon-rtr-list-network-stats command) content.
ConvertRequestParametersToTable	This script is used to convert CrowdStrike IOA request parameters to a table.
ConvertResponseElementsToTable	This script is used to convert CrowdStrike IOA response elements to a table.
ReadProcessesFile	Load and return the processes file (generated from the cs-falcon-rtr-list-processes command) content.
TransformIndicatorToCSFalconIOC	Transform a XSOAR indicator into a Crowd Strike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CS Falcon format. This JSON can be used as the input for the cs-falcon-batch-upload-custom-ioc command.
ConvertUserIdentityToTable	This script is used to convert CrowdStrike IOA user identity response elements to a table.
ConvertResourceAttributesToTable	This script is used to convert CrowdStrike IOM resource attributes to a table.

Name

Description

ConvertEnrichmentsToTable

This script is used to convert CrowdStrike IOA enrichments response elements to a table.

ReadNetstatFile

Load and return the processes file (generated from the cs-falcon-rtr-list-network-stats command) content.

ConvertRequestParametersToTable

This script is used to convert CrowdStrike IOA request parameters to a table.

ConvertResponseElementsToTable

This script is used to convert CrowdStrike IOA response elements to a table.

ReadProcessesFile

Load and return the processes file (generated from the cs-falcon-rtr-list-processes command) content.

TransformIndicatorToCSFalconIOC

Transform a XSOAR indicator into a Crowd Strike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CS Falcon format. This JSON can be used as the input for the cs-falcon-batch-upload-custom-ioc command.

ConvertUserIdentityToTable

This script is used to convert CrowdStrike IOA user identity response elements to a table.

ConvertResourceAttributesToTable

This script is used to convert CrowdStrike IOM resource attributes to a table.

Name	Description
CrowdStrike Falcon Incident Classifier	CrowdStrike Falcon Incident Classifier
CrowdStrike Falcon Mapper	CrowdStrike Falcon Mapper for incidents and detections
CrowdStrike Falcon - Outgoing Mapper	CrowdStrike Falcon mirror out mapper.

Name

Description

CrowdStrike Falcon Incident Classifier

CrowdStrike Falcon Mapper

CrowdStrike Falcon Mapper for incidents and detections

CrowdStrike Falcon - Outgoing Mapper

CrowdStrike Falcon mirror out mapper.

Name	Description
CrowdStrike Falcon Mobile platform version
CrowdStrike Falcon Detection Type
Behaviour Tactic	Behaviour Tactic
CrowdStrike Falcon Mobile Product
CrowdStrike Falcon User Identity
CrowdStrike Falcon Enrichments
Behaviour Objective	Behaviour Objective
CrowdStrike Falcon Vertex ID
CrowdStrike Falcon Firmware Build Fingerprint
CrowdStrike Falcon Response Elements
CrowdStrike Falcon Resource Attributes
CrowdStrike Falcon Service Type
CrowdStrike Falcon Vertex Type
CrowdStrike Falcon Request Parameters
CrowdStrike Falcon Behaviour Pattern Disposition Details
CrowdStrike Falcon Mobile Manufacturer
Behaviour Scenario	Behaviour Scenario
CrowdStrike Falcon Crawled Timestamp
CrowdStrike Falcon Pattern ID
CrowdStrike Falcon User Agent
CrowdStrike Falcon Firmware Build Time
CrowdStrike Falcon Security patch level

Name

Description

CrowdStrike Falcon Mobile platform version

CrowdStrike Falcon Detection Type

Behaviour Tactic

CrowdStrike Falcon Mobile Product

CrowdStrike Falcon User Identity

CrowdStrike Falcon Enrichments

Behaviour Objective

CrowdStrike Falcon Vertex ID

CrowdStrike Falcon Firmware Build Fingerprint

CrowdStrike Falcon Response Elements

CrowdStrike Falcon Resource Attributes

CrowdStrike Falcon Service Type

CrowdStrike Falcon Vertex Type

CrowdStrike Falcon Request Parameters

CrowdStrike Falcon Behaviour Pattern Disposition Details

CrowdStrike Falcon Mobile Manufacturer

Behaviour Scenario

CrowdStrike Falcon Crawled Timestamp

CrowdStrike Falcon Pattern ID

CrowdStrike Falcon User Agent

CrowdStrike Falcon Firmware Build Time

CrowdStrike Falcon Security patch level

Name	Description
CrowdStrike Falcon IOA Event
CrowdStrike Falcon Incident
CrowdStrike Falcon IDP Detection
CrowdStrike Falcon IOM Event
CrowdStrike Falcon Detection
CrowdStrike Falcon Mobile Detection

Name

Description

CrowdStrike Falcon IOA Event

CrowdStrike Falcon Incident

CrowdStrike Falcon IDP Detection

CrowdStrike Falcon IOM Event

CrowdStrike Falcon Detection

CrowdStrike Falcon Mobile Detection

Name	Description
CrowdStrike Falcon	The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.

Name

Description

CrowdStrike Falcon

The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.

Name	Description
CrowdStrike Falcon Layout

Name

Description

CrowdStrike Falcon Layout

Name	Description
Crowdstrike Falcon - Isolate Endpoint	This playbook will auto isolate endpoints by the device ID that was provided in the playbook.
CrowdStrike Falcon - Block File	This playbook receives an MD5 or a SHA256 hash and adds it to the block list in CrowdStrike Falcon. The playbook uses the integration "CrowdStrike Falcon".
CrowdStrike Falcon - True Positive Incident Handling	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it.
CrowdStrike Falcon Malware - Investigation and Response	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike Falcon malware investigation, including: Extracting and displaying MITRE data from the EDR and sandboxes Deduplicating similar incidents Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox. Verifying the actions taken by the EDR Analyzing the command line Searching for relevant hashes in additional hosts in the organization Retrieving data about the host, including process list and network connections Performing containment and mitigation actions as part of handling false/true positives Setting the relevant layouts
CrowdStrike Falcon - Get Detections by Incident	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables getting CrowdStrike Falcon detection details based on the CrowdStrike incident ID.
Crowdstrike Falcon - Unisolate Endpoint	This playbook unisolates devices according to the device ID that is provided in the playbook input.
CrowdStrike Falcon - Retrieve File	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.
CrowdStrike Falcon - SIEM ingestion Get Incident Data	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles incident ingestion from a SIEM. The user provides the field for the incident ID or detection ID and the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type.
CrowdStrike Falcon - Search Endpoints By Hash	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash.
CrowdStrike Falcon Malware - Incident Enrichment	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.
CrowdStrike Falcon Malware - Verify Containment Actions	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook verifies and sets the policy actions applied by CrowdStrike Falcon.
CrowdStrike Falcon - False Positive Incident Handling	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it.
CrowdStrike Falcon - Get Endpoint Forensics Data	This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.

Name

Description

Crowdstrike Falcon - Isolate Endpoint

This playbook will auto isolate endpoints by the device ID that was provided in the playbook.

CrowdStrike Falcon - Block File

This playbook receives an MD5 or a SHA256 hash and adds it to the block list in CrowdStrike Falcon.
The playbook uses the integration "CrowdStrike Falcon".

CrowdStrike Falcon - True Positive Incident Handling

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it.

CrowdStrike Falcon Malware - Investigation and Response

Extracting and displaying MITRE data from the EDR and sandboxes
Deduplicating similar incidents
Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.
Verifying the actions taken by the EDR
Analyzing the command line
Searching for relevant hashes in additional hosts in the organization
Retrieving data about the host, including process list and network connections
Performing containment and mitigation actions as part of handling false/true positives
Setting the relevant layouts

CrowdStrike Falcon - Get Detections by Incident

Crowdstrike Falcon - Unisolate Endpoint

This playbook unisolates devices according to the device ID that is provided in the playbook input.

CrowdStrike Falcon - Retrieve File

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.

CrowdStrike Falcon - SIEM ingestion Get Incident Data

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook handles incident ingestion from a SIEM.
The user provides the field for the incident ID or detection ID and the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type.

CrowdStrike Falcon - Search Endpoints By Hash

CrowdStrike Falcon Malware - Incident Enrichment

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.

CrowdStrike Falcon Malware - Verify Containment Actions

CrowdStrike Falcon - False Positive Incident Handling

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook handles a CrowdStrike incident that was determined
to be a false positive by the analyst. Actions include unisolating the host, allowing
the indicator by the EDR, and tagging it.

CrowdStrike Falcon - Get Endpoint Forensics Data

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Malware Investigation and Response	By: Cortex XSOAR

Pack Name	Pack By
Atlassian Jira	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Pack Name	Pack By
Rasterize	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Malware Investigation and Response	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Base	By: Cortex XSOAR

Certification	Certified	Read more
Supported By	Cortex
Created	September 9, 2020
Last Release	April 11, 2024

What Does This Pack Do?

Before You Start

Pack Configurations

Integrations

CrowdStrike Falcon

Mappers

CrowdStrike Falcon Mapper

Integrations

CrowdStrike Falcon

Playbooks

CrowdStrike Falcon - True Positive Incident Handling

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Classifiers

CrowdStrike Falcon Incident Classifier

Incident Fields

Incident Types

Integrations

CrowdStrike Falcon

Mappers

CrowdStrike Falcon Mapper

CrowdStrike Falcon - Outgoing Mapper

Integrations

CrowdStrike Falcon

Playbooks

CrowdStrike Falcon - Search Endpoints By Hash

Integrations

CrowdStrike Falcon

Playbooks

CrowdStrike Falcon - Retrieve File

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Playbooks

New: CrowdStrike Falcon - Block File

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Playbooks

CrowdStrike Falcon Malware - Incident Enrichment

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Classifiers

CrowdStrike Falcon Incident Classifier

Incident Fields

Incident Types

Integrations

CrowdStrike Falcon

Layouts

Mappers

CrowdStrike Falcon Mapper

Scripts

New: ConvertUserIdentityToTable

New: ConvertEnrichmentsToTable

New: ConvertRequestParametersToTable

New: ConvertResourceAttributesToTable

New: ConvertResponseElementsToTable

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon

Integrations

CrowdStrike Falcon