Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The CrowdStrike Falcon Intelligence operation queries the CrowdStrike Falcon Intelligence API to retrieve further information about submitted indicators.

The operation provides the following action:

• Query - queries the CrowdStrike Falcon Intelligence API for further information on the submitted indicator.

The operation is compatible with indicator type system objects.

Prerequisites

The following is required in order to run the operation:

• CrowdStrike Client ID and Client Secret
• Properly scoped CrowdStrike API Client
• MITRE ATT&CK Feeds (optional)

CrowdStrike API Client

To use the CrowdStrike Falcon Intelligence resources, you must create a properly scoped API Client within CrowdStrike's Falcon platform. API Clients can be created and configured via the API Clients and Keys page under Support. An API Client must be created for this operation and given the following API Read Scopes by clicking the Add new API Client button:

• Actors (Falcon X)
• Indicators (Falcon X)

It is typically a good idea to give the API Client an identifiable name in case of future editing.

MITRE ATT&CK Feeds

To automatically ingest Attack Patterns, please make sure you have installed and run the following feeds successfully before using this operation:

• MITRE Enterprise ATT&CK
• MITRE Mobile ATT&CK
• MITRE PRE-ATT&CK

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration whl file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the whl file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine

   ThreatQ will inform you if the operation already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the operation contains changes to the user configuration. The new user configurations will overwrite the existing ones for the operation and will require user confirmation before proceeding.

The operation is now installed and will be displayed in the ThreatQ UI. You will still need to configure and then enable the operation.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API Hostname	The API host to communicate with CrowdStrike.
   CrowdStrike Client ID	The CrowdStrike Client ID used to authenticate.
   CrowdStrike Client Secret	The CrowdStrike Client Secret used to authenticate.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following action:

Query

The Query action queries Crowdstrike Falcon Intelligence API for an indicator.

{
  "filter": "indicator: 'cb0fa82c79b7eed6ba356991c4c89161403162ef56d4e76c528bca857b08cb7a'",
  "sort": "last_updated|desc",
  "limit": 1
}

{
  "meta": {
    "query_time": 0.053664582,
    "pagination": {
      "offset": 0,
      "limit": 1,
      "total": 1
    },
    "powered_by": "msa-api",
    "trace_id": "e6e8a29a-dacd-4aca-bb69-24e8251dd843"
  },
  "resources": [
    {
      "id": "hash_sha256_cb0fa82c79b7eed6ba356991c4c89161403162ef56d4e76c528bca857b08cb7a",
      "indicator": "cb0fa82c79b7eed6ba356991c4c89161403162ef56d4e76c528bca857b08cb7a",
      "type": "hash_sha256",
      "deleted": false,
      "published_date": 1708907561,
      "last_updated": 1709724487,
      "reports": [
        "CSA-18538"
      ],
      "actors": [
        "FANCYBEAR"
      ],
      "malware_families": [
        "ContiRansomware"
      ],
      "kill_chains": [
        "ActionOnObjectives"
      ],
      "ip_address_types": [
        "TorProxy"
      ],
      "domain_types": [
        "ActorControlled"
      ],
      "malicious_confidence": "high",
      "_marker": "1709724487150f1363aeae1c25de63a7a8b2814fb9",
      "labels": [
        {
          "name": "MitreATTCK/Impact/QueryRegistry",
          "created_on": 1708907563,
          "last_valid_on": 1708907563
        },
        {
          "name": "ThreatType/Criminal",
          "created_on": 1595592139,
          "last_valid_on": 1693409035
        }
      ],
      "relations": [
        {
          "id": "hash_sha1_d17c1a5550fab6ce451df922781fe8534dcd9167",
          "indicator": "d17c1a5550fab6ce451df922781fe8534dcd9167",
          "type": "hash_sha1",
          "created_date": 1708907561,
          "last_valid_date": 1708907561
        }
      ],
      "targets": [
        "Finance"
      ],
      "threat_types": [
        "Criminal",
        "Ransomware"
      ],
      "vulnerabilities": [
        "CVE-2020-1234"
      ]
    }
  ],
  "errors": []
}

Run Parameters

The following parameters are available when selecting to run the Action against an object:

Indicator Type Mapping

The following tables provides CrowdStrike to ThreatQ Indicator type mapping.

Change Log

• Version 1.0.0
  • Initial release