CrowdStrike Falcon
Source: CrowdStrike. Professional tier. CICADA signs in with an API client ID and secret (OAuth2 client credentials at /oauth2/token) against the base URL of your Falcon cloud.
Create the API client
- In the Falcon console open the vendor's Support and resources > API clients and keys menu and create a client named for CICADA.
- Tick the scopes in the table below for the capabilities you want.
- Copy the client ID and secret. The secret is shown once.
- In CICADA, Sources > Add Source > CrowdStrike: Base URL, Client ID, Client Secret. Press Test Connection.
Scopes
These are the scope names the connector records. Match them against the scope list on the API client screen (the console groups them by API and labels them Read or Write).
| Scope | Endpoints CICADA calls | Needed for |
|---|---|---|
detections:read (Alerts, read) | GET /alerts/queries/alerts/v2, POST /alerts/entities/alerts/v2 | Collecting detections. Always. |
hosts:read | GET /devices/queries/devices/v1, GET /devices/entities/devices/v2 | Collecting device records; the connection test; finding a device before an action. Always. |
hosts:write | POST /devices/entities/devices-actions/v2 with action_name=contain or lift_containment | Isolate Device and Lift Containment |
iocs:read (with hosts:read) | GET /iocs/queries/indicators/devices/v1 | Search File Hash: which hosts have seen a hash |
iocs:write | POST /iocs/entities/indicators/v1 | Block File Hash through a custom indicator |
| Real time response: read, write, and admin write | GET /devices/queries/devices-scroll/v1, /real-time-response/entities/sessions/v1, /admin-command/v1, /file/v2, /extracted-file-contents/v1 | Optional. Playbook content sampling pulls a bounded sample of a file from a host through an RTR session. Without the admin scope the file is recorded as not sampled. |
Base URL per region
| Cloud | Base URL |
|---|---|
| US-1 | https://api.crowdstrike.com (default) |
| US-2 | https://api.us-2.crowdstrike.com |
| EU-1 | https://api.eu-1.crowdstrike.com |
| US-GOV-1 | https://api.laggar.gcw.crowdstrike.com |
The appliance needs outbound HTTPS to the one host for your cloud. Network Requirements lists US-1, US-2 and EU-1; the US-GOV-1 host comes from the connector's own notes and is not on that page, so add it to your firewall rule by hand if you use it.
What is collected
- Alerts from the Alerts API v2. Each behaviour is its own alert with a composite ID; tactic, technique, hashes, file name and user are top-level fields, and severity is numeric with a display name. The older Detections API and the Incidents API were retired by CrowdStrike and are not called.
- Devices: host records from the Devices API, for hostnames, IPs, OS and sensor state.
Containment and indicator actions
| Action | What CICADA sends | What it checks | Undo |
|---|---|---|---|
| Isolate Device | contain on the device ID | Re-reads the device; contained is done, containment_pending means the sensor has not applied it yet | Lift Containment |
| Lift Containment | lift_containment on the device ID | Re-reads the device; normal is done, lift_containment_pending means the sensor has not applied it yet | Isolate Device |
| Search File Hash | Looks up the hash in the indicator-device index and fetches the device details | Read only; auto-approved | None needed |
| Block File Hash | Creates a custom IOC indicator that prevents execution of the hash on all platforms | Returns the indicator ID and a link to the console indicator list | CICADA does not delete the indicator. Remove it in the Falcon console (Endpoint security, IOC management) or with DELETE /iocs/entities/indicators/v1?ids=<indicator>; the indicator ID is stored on the action. |
A successful action in a live investigation is also written to the evidence chain. The chain record names the operator as cicada-system; the approver's email is on the action row and its audit events, not on the chain record.
What Test Connection tells you
- Connected to CrowdStrike Falcon: the client ID and secret work and
hosts:readis granted. - Authentication failed: Invalid client credentials. Verify client_id and client_secret.: the token request was refused. Wrong client ID or secret.
- Authentication failed: CrowdStrike authentication failed (HTTP N): ..., Authentication failed: Authentication failed (HTTP N): ... or Authentication failed: Network error during authentication: ...: the token request did not get a normal answer. Usually the wrong base URL for your cloud, or no route to it.
- Authentication failed: Access denied. Verify API client scopes and CID permissions.: the token endpoint answered 403. The client exists but is not allowed to issue a token for this CID.
- Access denied: Missing API scopes: a token was issued but the device query was refused. The client lacks
hosts:read. - Authentication expired or invalid: a token was issued but the device query answered 401. Rare; re-enter the credentials.
CrowdStrike is also available as a threat intelligence provider with its own key; see Threat intelligence providers.