Integrating with CrowdStrike Falcon Endpoint Protection

Overview

CrowdStrike provides an API that allows Blumira to retrieve event data. When configured, the Blumira integration with CrowdStrike Falcon Endpoint Protection will stream server and workstation endpoint security event logs and alerts to the Blumira service for threat detection and actionable response. If you are using CrowdStrike, please follow this guide to begin ingesting its data.

Note: this integration pertains to the newer CrowdStrike OAuth2-Based APIs, not the legacy Streaming APIs, which CrowdStrike is retiring. Also, the Blumira module currently only supports CS Detections, but additional API feeds may be enabled as new features are released.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Next, in the CrowdStrike Falcon Console, create a new API client and gather the Client ID and Client Secret, which are necessary for Blumira to access the CrowdStrike API.

To obtain these credentials, follow these instructions:

1. Log in to the CrowdStrike Falcon Console.
2. Navigate to Support > API Clients and Keys.
3. Click Add new API client in the OAuth2 API Clients section.
4. Type Blumira Events in the Client Name field.
5. In the Description field, type a description that makes sense to your organization.
6. Select the Read check box next to each of the following (ignore any that you do not use):
   • Detections
   • Hosts
   • Actors (Falcon X)
   • Reports (Falcon X)
   • Host Groups
   • Event Streams
     
7. Click Add.
8. In the API client created window, copy and save the Client ID and Client Secret.
   Caution: the secret will only be shown once and should be stored in a secure place.
9. Click Done.

Providing API credentials to Blumira

Next, configure your existing Blumira sensor with a new module to connect to the CrowdStrike API using the credentials you obtained in previous steps.

To add a module on an existing sensor and provide credentials:

1. In Blumira, click Settings.
2. Click Sensors.
3. Click the sensor on which you want to add a module.
4. On the detail page for the sensor, scroll down and click Add Module.
5. In the Add New Module window, select the relevant module.
6. Enter the credentials that you gathered in previous steps.
7. (Optional) Type a name for this log deployment in the Log Source Name box.
   Note: Use alphanumeric characters, periods, and hyphens. Spaces and underscores are not allowed. This name will appear in the "device_address" column in the results of your event data queries. If you add more modules to collect logs for other integrations, this name will help you to identify them. 
8. Click Install.