Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiple Analyzers & Responders for CrowdstrikeFalcon #1297

Merged
merged 3 commits into from
Nov 26, 2024

Conversation

nusantara-self
Copy link
Contributor

Closes #1296

  1. New Analyzers:

    • CrowdstrikeFalcon Sandbox:
      • Submits file observables to the CrowdStrike Falcon Sandbox for analysis.
      • Retrieves results once the analysis is complete.
    • CrowdstrikeFalcon getDeviceAlerts:
      • Retrieves alerts associated with a specific hostname over a defined time range.
    • CrowdstrikeFalcon getDeviceDetails:
      • Fetches detailed information for a given hostname in CrowdStrike Falcon, including if the agent is in fully functional mode.
    • CrowdstrikeFalcon getDeviceVulnerabilities:
      • Retrieves the list of vulnerabilities impacting a specific device.
  2. New Responders:

    • CrowdstrikeFalcon IOC:
      • Adds or removes Indicators of Compromise (IoCs) in the CrowdStrike Falcon platform.
      • Supports hashes, IPs, urls & domains.
    • CrowdstrikeFalcon Hosts:
      • Contains hosts
      • lift containment
      • Suppress detection, hide host etc..
    • CrowdstrikeFalcon Sync:
      • Synchronizes the status of alerts and incidents between TheHive (alert or case stages) and CrowdStrike
  3. Matching analyzers reports

@nusantara-self nusantara-self added this to the 3.3.9 milestone Nov 26, 2024
@nusantara-self nusantara-self self-assigned this Nov 26, 2024
@nusantara-self nusantara-self merged commit a0f139f into develop Nov 26, 2024
@nusantara-self nusantara-self deleted the csfalcon-integration-1 branch February 21, 2025 07:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant