CrowdStrike Developer Center

CrowdStrike Parsing Standard (CPS)

Mon, 01 Jan 0001 00:00:00 +0000

The standard is based on Elastic Common Schema (ECS), with all deviations and clarifications noted below.

Changelog #

1.1.0 #

Compared to the previous standard from the Package Standards document, the Parsing Standard is changed in the following ways:
- Adds rule of keeping original Vendor. field when normalizing to ECS
- Adds event.severity mapping rules
- Updates the rules and explanation for parser versioning
- Adds rule of using array:append with event.category and event.type
- Adds rule to lowercase all *.email field values
- Adds rule that event.kind := "alert" should only be set when event.category, event.type, and event.severity fields are present and set

1.0.0 #

The Parsing Standard was previously embedded in the old Package Standards document. That document still exists to document our approach to packages as a whole, but the parsing standard has been extracted so it can be referenced outside of packages. Going forward, the PaSta acronym refers to the parsing standard only.
Compared to the previous standard from the Package Standards document, the Parsing Standard is changed in the following ways:
- Adds new fields to tag
- Removes the Product field, replaced by guidelines for event.module and event.dataset
- Removes the event.code field (to be reinstated later)
- Removes the related fields
- Normalises values for a range of new fields

Version 1.1.0 #

We use the latest 9.x version of ECS (which is the current major version at the time of writing). We are free to upgrade to minor and patch revisions without updating this standard, but going to a new major version requires a new revision of the standard.

Parser Template

Mon, 01 Jan 0001 00:00:00 +0000

Below is a template you can use to start writing your own parser for Next-Gen SIEM. See completed parsers for other examples.

name: template
tests: []
$schema: https://schemas.humio.com/parser/v0.3.0
script: |
  // #region PREPARSE
  /************************************************************
  ****** Parse timestamp and log headers
  ****** Extract message field for parsing 
  ****** Parse structured data 
  ************************************************************/
    
  
  // #endregion

  // #region METADATA
  /************************************************************
  ****** Static Metadata Definitions
  ************************************************************/
  | ecs.version := "9.0.0"
  | Cps.version := "1.1.0"
  | Parser.version := "1.0.0"
  | Vendor := ""
  | event.module := ""
  | event.dataset := ""

  // #endregion

  // #region NORMALIZATION
  /************************************************************
  ****** Parse unstructured data (i.e. message field)
  ****** Normalize fields to data model
  ************************************************************/


  // #endregion

  // #region POST-NORMALIZATION
  /************************************************************
  ****** Post Normalization
  ****** Custom parser logic needed after normalization
  ************************************************************/


  // #endregion

tagFields:
- Cps.version
- Vendor
- ecs.version
- event.dataset
- event.kind
- event.module
- event.outcome
- observer.type

Completed Parsers #

Click on the links below to download completed parsers.

Community

Mon, 01 Jan 0001 00:00:00 +0000

CrowdStrike Subreddit

Questions regarding CrowdStrike and discussion related directly to CrowdStrike products and services, integration partners, and security articles.

r/crowdstrike

The CrowdStrike Community

A place to connect with other CrowdStrike users, discuss best practices, and solve problems faster.

community.crowdstrike.com

GitHub Discussions

FalconPy
PSFalcon

Get Started with Falcon Fusion SOAR

Mon, 02 Dec 2024 17:00:00 +0000

The Oxford dictionary defines soar as to “fly or rise high in the air”. While this pairs nicely with Falcon, SOAR is an acronym, not a word, when it comes to cybersecurity. In a cybersecurity context, SOAR stands for Security Orchestration, Automation, and Response, which is a group of technologies that enable organizations to automatically respond to certain security events.

Falcon Fusion SOAR is an orchestration engine that allows you to create scheduled or on-demand workflows to automate processes across the Falcon platform. First-party actions provided by CrowdStrike include device queries, sending email, creating Jira tickets, writing to logs, and many others.

Get Started with Falcon Foundry

Wed, 30 Oct 2024 15:30:00 +0000

Developers and professionals who work within the cybersecurity industry are constantly looking to create more dynamic and impactful integrations between CrowdStrike’s Falcon platform and other security and IT tools. In order to help better facilitate that, CrowdStrike has introduced Falcon Foundry.

The Falcon platform has numerous modules with analytic and response features to hunt and defend against today’s adversaries. Now you can develop custom solutions to extend the power of the Falcon platform to your specific needs by leveraging Falcon Foundry. Falcon Foundry, cybersecurity’s first low-code application platform, gives you the ability to build apps, extensions, and API integrations to leverage additional organizational detail within the Falcon console. You can also increase awareness and expand visibility using Falcon Next-Gen SIEM to ingest additional third-party data sources.

CrowdStrike SDKs

Mon, 01 Jan 0001 00:00:00 +0000

The CrowdStrike SDKs provide an open source solution for interacting with all CrowdStrike API endpoints using your preferred language.

FalconJS
(JavaScript)

FalconPy
(Python)

goFalcon
(Golang)

PSFalcon
(PowerShell)

Rusty Falcon
(Rust)

Crimson Falcon
(Ruby)

event.module guidelines

Mon, 01 Jan 0001 00:00:00 +0000

If you are creating a package with a vendor and module that has already been used in other packages, make sure to reuse the same name as they have in here. If you create a package for a new module, add the module name here.

When choosing a new module name, use something that is concise and clear, without hyphens in the names.

Module names per vendor #

Vendor	`#event.module`	Product Full Name
1password	devicetrust	1Password Device Trust
1password	passwordmanager	1Password Password Manager
a10	thunder	A10 Thunder Application Delivery Controller
abnormal	email-security	Abnormal Email Security
airlockdigital	airlock	Airlock Application Control
akamai	api	Akamai API Gateway
akamai	asec	Akamai Security Events
akamai	cdn	Akamai Content Delivery Network
akamai	eaa	Akamai Enterprise Application Access
akamai	guardicore	Akamai Guardicore Centra
apache	httpserver	Apache HTTP Server
apache	tomcat	Apache Tomcat
appomni	threatdetection	AppOmni Threat Detection
arista	ndr	Arista NDR Platform
armis	centrixiot	Armis Centrix IoT Security
aruba	clearpass	Aruba ClearPass
aruba	orchestrator	Aruba Orchestrator
asimily	iomt	Asimily IoMT Security Platform
atlassian	jira	Atlassian Jira
aws	aws-generic	Amazon Web Services Generic
aws	cloudtrail	AWS CloudTrail
aws	cloudwatch	AWS CloudWatch
aws	config	AWS Config
aws	fsx	Amazon FSx
aws	guardduty	AWS GuardDuty
aws	network-firewall	AWS Network Firewall
aws	rds	Amazon Relational Database Service
aws	route53	Amazon Route 53
aws	s3access	Amazon S3 Server Access
aws	security-hub	AWS Security Hub
aws	securitylake	AWS Security Lake
aws	vpcflow	Amazon VPC Flow Logs
aws	waf	AWS Web Application Firewall
barracuda	cgf	Barracuda CloudGen Firewall
barracuda	emailgatewaydefense	Barracuda Email Gateway Defense
beyondtrust	beyondinsight	BeyondTrust BeyondInsight
box	enterprise	Box Enterprise
broadcom	bluecoat	Broadcom Blue Coat Proxy
broadcom	fos	Broadcom Fabric Operating System
broadcom	proxysg	Broadcom ProxySG
broadcom	symantec-endpointprotection	Broadcom Symantec Endpoint Protection
cato	sase	Cato SASE Cloud
cetu	pipelines	CeTu Pipelines
checkpoint	harmonyemailcollaboration	Check Point Harmony Email & Collaboration
checkpoint	ngfw	Check Point Next Generation Firewall
cisco	asa	Cisco Adaptive Security Appliance
cisco	duo	Cisco Duo Security
cisco	firepower	Cisco Firepower
cisco	ios	Cisco IOS
cisco	ise	Cisco Identity Services Engine
cisco	meraki	Cisco Meraki
cisco	prime	Cisco Prime
cisco	secure-network-analytics	Cisco Secure Network Analytics
cisco	seg	Cisco Secure Email Gateway
cisco	threatgrid	Cisco Threat Grid
cisco	umbrella	Cisco Umbrella
citrix	adc	Citrix Application Delivery Controller
claroty	ctd	Claroty Continuous Threat Detection
cloudflare	waf	Cloudflare Web Application Firewall
cloudflare	zerotrust	Cloudflare Zero Trust
cofense	triage	Cofense Triage
contrastsecurity	adr	Contrast Security Application Defense and Response
corelight	ids	Corelight Network Detection and Response
corelight	investigator	Corelight Investigator
corelight	ndr	Corelight Network Detection and Response
crowdstrike	falcon	CrowdStrike Falcon
crowdstrike	saas-security	CrowdStrike SaaS Security
cyberark	vault	CyberArk Privileged Access Security
cynerio	healthcarendr	Cynerio Healthcare Network Detection and Response
darktrace	detect	Darktrace Enterprise Immune System
delinea	secretserver	Delinea Secret Server
dell	isilon	Dell PowerScale OneFS
dell	powerprotect	Dell PowerProtect Data Manager
dope-security	dope-swg	Dope Security Secure Web Gateway
dragos	platform	Dragos Platform
druva	realize	Druva Data Resiliency Cloud
enzoic	e4ad	Enzoic for Active Directory
epicsecurity	epic	Epic Electronic Health Records
extrahop	revealx-360	ExtraHop Reveal(x) 360
f5networks	bigip	F5 BIG-IP
f5networks	nginx	F5 NGINX
fidelis	audit	Fidelis Audit
fidelis	fidelis	Fidelis Network
forcepoint	dlp	Forcepoint Data Loss Prevention
forcepoint	ngfw	Forcepoint Next Generation Firewall
forgerock	identity	ForgeRock Identity Platform
fortinet	fortigate	Fortinet FortiGate
fortinet	fortimail	Fortinet FortiMail
fortinet	fortindr	Fortinet FortiNDR
gigamon	ami	Gigamon Application Metadata Intelligence
google	chromeenterprise	Google Chrome Enterprise
google	cloud	Google Cloud Identity
google	gcp	Google Cloud Platform
google	workspace	Google Workspace
gytpol	misconfigurations	GYTPOL Misconfigurations
haproxy	haproxy	HAProxy Load Balancer
hashicorp	vault	HashiCorp Vault
imperva	cloudwaf	Imperva Cloud Web Application Firewall
infoblox	nios	Infoblox Network Identity Operating System
ironscales	esp	IRONSCALES Email Security Platform
island	island	Island Enterprise Browser
juniper	srx	Juniper SRX Series
keepersecurity	enterprise	Keeper Enterprise Password Management
linux	auditd	Linux Audit Daemon
linux	linux	Linux Operating System
linux	syslog	Linux System Logging
logbinder	sharepoint	LogBinder SharePoint
lookout	mobile	Lookout Mobile Endpoint Security
menlo	msip	Menlo Security Isolation Platform
microsoft	ad	Microsoft Active Directory
microsoft	azure	Microsoft Azure
microsoft	azure-devops	Microsoft Azure DevOps
microsoft	defender	Microsoft Defender
microsoft	defender-identity	Microsoft Defender for Identity
microsoft	edge	Microsoft Edge
microsoft	entraid	Microsoft Entra ID
microsoft	exchange	Microsoft Exchange
microsoft	github	Microsoft GitHub Enterprise
microsoft	iis	Microsoft Internet Information Services
microsoft	intune	Microsoft Intune
microsoft	m365	Microsoft 365
microsoft	messagetrace	Microsoft Message Trace
microsoft	sentinel	Microsoft Sentinel
microsoft	sql	Microsoft SQL Server
microsoft	windows	Microsoft Windows
microsoft	windows-defender-365	Microsoft Defender for Office 365
mimecast	emailsecurity	Mimecast Email Security
nasuni	edge	Nasuni Edge Appliance
nasuni	managementconsole	Nasuni Management Console
netgate	pfsense	Netgate pfSense
netskope	sse	Netskope Security Service Edge
netskope	transaction	Netskope Transaction Logs
nozomi	ids	Nozomi Networks Guardian
nozomi	nozomi	Nozomi Networks Platform
nutanix	datalens	Nutanix Data Lens
obsidiansecurity	securitydata	Obsidian Security Platform
okta	sso	Okta Single Sign-On
oneidentity	onelogin	OneLogin Identity Platform
ordr	ordrai	Ordr Systems Control Engine
paloalto	dlp	Palo Alto Networks Enterprise DLP
paloalto	ngfw	Palo Alto Networks Next-Generation Firewall
paloalto	prisma	Palo Alto Networks Prisma Access
paloalto	prismasdwan	Palo Alto Networks Prisma SD-WAN
paloalto	saas-security	Palo Alto Networks SaaS Security
pingidentity	pingone	PingOne Platform
proofpoint	casb	Proofpoint Cloud App Security Broker
proofpoint	emailprotection	Proofpoint Email Protection
proofpoint	seg	Proofpoint Email Security Gateway
proofpoint	tap	Proofpoint Targeted Attack Protection
pulse	secure	Pulse Secure VPN
purestorage	flasharray	Pure Storage FlashArray
purestorage	flashblade	Pure Storage FlashBlade
qualys	vm	Qualys Vulnerability Management
radware	alteon	Radware Alteon Application Delivery Controller
radware	waf	Radware Cloud Web Application Firewall
raynet	raynetone	RayNet One Platform
redhat	jboss	Red Hat JBoss Enterprise Application Platform
rubrik	securitycloud	Rubrik Security Cloud
sailpoint	identitynow	SailPoint IdentityNow
salesforce	salesforce	Salesforce Platform
saltsecurity	apisecurity	Salt Security API Protection Platform
seraphic	seraphicsecurity	Seraphic Security Platform
servicenow	servicenow	ServiceNow Platform
silverfort	itdr	Silverfort Identity Threat Detection and Response
skyhigh	sse	Skyhigh Security Service Edge
softerra	adaxes	Softerra Adaxes
sonicwall	sonicos	SonicWall SonicOS
sophos	sfos	Sophos Firewall Operating System
squid	proxy	Squid Proxy Server
superna	securityedition	Superna Eyeglass Data Security Edition
tausight	ephi	Tausight ePHI Security Platform
trellix	fireeyenx	Trellix Network Security
trendmicro	visionone	Trend Micro Vision One
tufin	securetrack	Tufin SecureTrack
varonis	varonis	Varonis Data Security Platform
vectra	brain	Vectra Cognito Detect
vectra	respond-ux	Vectra Respond User Experience
veeam	vbr	Veeam Backup & Replication
vercara	ultradns	Vercara UltraDNS
veriti	insight	Veriti Security Posture Management
versa	sase	Versa SASE
versa	vos	Versa Operating System
viavi	observerapex	VIAVI Observer Apex
vmware	airwatch	VMware Workspace ONE UEM
vmware	esxi	VMware ESXi
vmware	vcenter	VMware vCenter Server
watchguard	firebox	WatchGuard Firebox
workday	workday	Workday Platform
zimperium	mtd	Zimperium Mobile Threat Defense
zoom	qss	Zoom Quality of Service Subscription
zoom	zoom	Zoom Communications Platform
zscaler	deception	Zscaler Deception
zscaler	zia	Zscaler Internet Access
zscaler	zpa	Zscaler Private Access

Foundry Samples

Mon, 01 Jan 0001 00:00:00 +0000

Start with our Foundry Quickstart to get up and running quickly, explore our Featured Foundry Samples to see what’s possible, then dive into the full collection of Foundry Samples on GitHub to find exactly what you need for your use case.

Foundry Quickstart #

Ready to build your first Foundry app? Start with our step-by-step tutorial that walks you through the complete development workflow - from CLI setup to app deployment.

OpenAPI Docs

Mon, 01 Jan 0001 00:00:00 +0000

Note

You must be logged into the Falcon console in order to access the OpenAPI specification and docs.

Cloud environment	API reference info link
US-1	https://assets.falcon.crowdstrike.com/support/api/swagger.html
US-2	https://assets.falcon.us-2.crowdstrike.com/support/api/swagger-us2.html
EU-1	https://assets.falcon.eu-1.crowdstrike.com/support/api/swagger-eu.html
US-GOV-1	https://assets.falcon.laggar.gcw.crowdstrike.com/support/api/swagger-eagle.html
US-GOV-2	https://assets.falcon.us-gov-2.crowdstrike.mil/support/api/swagger.html

Falcon Documentation #

Explore Falcon’s documentation and learn about its modules you can use to help fight the adversaries!

Falcon Documentation

Vendor Guidelines

Mon, 01 Jan 0001 00:00:00 +0000

If you are creating a package with a vendor that has already been used in other packages, make sure to use the same name as they have in here. If you create a package for a new vendor, add the vendor name here.

When choosing a new name, use something that is concise and clear, and use full words instead of abbreviations. E.g. choose “apple” instead of “Apple Inc.” and “aws” over “amazon”. Remember that the vendor name should most likely also be used for the scope of your package, so it must abide by the rules those use:

CrowdStrike Developer Center

CrowdStrike Parsing Standard (CPS)

Changelog #

1.1.0 #

1.0.0 #

Version 1.1.0 #

Parser Template

Completed Parsers #

Community

CrowdStrike Subreddit

The CrowdStrike Community

GitHub Discussions

Get Started with Falcon Fusion SOAR

Get Started with Falcon Foundry

CrowdStrike SDKs

FalconJS(JavaScript)

FalconPy(Python)

goFalcon(Golang)

PSFalcon(PowerShell)

Rusty Falcon(Rust)

Crimson Falcon(Ruby)

event.module guidelines

Module names per vendor #

Foundry Samples

Foundry Quickstart #

OpenAPI Docs

Note

Falcon Documentation #

Vendor Guidelines

FalconJS
(JavaScript)

FalconPy
(Python)

goFalcon
(Golang)

PSFalcon
(PowerShell)

Rusty Falcon
(Rust)

Crimson Falcon
(Ruby)