CrowdStrike

The Dropzone AI platform integrates with the CrowdStrike APIs. This document describes how to set up API credentials and install them into the Dropzone platform.

Integration Overview

To enable these integrations you will perform the following actions:

• Create API credentials in the CrowdStrike dashboard
• Install the credentials into your Dropzone tenant (Data Source and Alert Source)
• Select integration parameters, such as which alert types to sync

Create an API Key

• As an Admin, go to your CrowdStrike dashboard, e.g. https://falcon.us-#.crowdstrike.com/

• From the menu in the upper left, navigate to Support and Resources > API clients and keys

• On the right, click "Create API Client"

• On the "Create API Client" page, input "Dropzone AI" in the client name field. Under "Description," write "Dropzone AI Integration Key"

• Enable the following scopes:

• Write permission details
  • Cases: Write permissions are only required when used in Response Actions
  • Hosts: Write permissions are only required when used in Remediator Containment Actions
  • NGSIEM: Write permissions are required when NextGen SIEM is enabled in order to execute NGSIEM queries (docs)
  • Real Time Response: Write permissions are required when File Retrieval is enabled (docs)
    • Dropzone only uses Real Time Response to perform get <file> commands
  • Identity Protection GraphQL: Write permissions are required when Identity Protection is enabled in order to execute queries for user directory information (docs)
  • Sandbox (Falcon Intelligence: Write permissions are only required when File Detonation is enabled in order to upload collected or attached files in the Falcon Sandbox
  • Indicators of Compromise: Write permissions are only required when used in Remediator Containment Actions
• When done, click "Create"
• Copy the Client ID and Secret for use later in the Dropzone UI where they are called "Client ID" and "Client Secret" respectively

Enable Crowdstrike

The Alert source integration allows Dropzone AI to pull alerts from CrowdStrike for investigation.

You'll need the following information:

To enable the Alert Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search CrowdStrike, then click "Configure"

• Under the Alert Source header, input the Client ID and Client Secret. If you use a non-default URL for the CrowdStrike API, configure the API Base URL as well

• If you wish to enable endpoint detection, check the box labeled "Enable Endpoint Detection." Then select the severity levels you want Dropzone to investigate alerts for

• Under Exclusions, you may choose to exclude alerts by display name. To do so, click "Add Item," then input a list of Python regexes of the alerts you wish to exclude

• If you wish to enable CrowdStrike's Next-Gen SIEM cases, check the box labeled "Enable Next-gen SIEM Cases"

• Input the minimum case severity you want Dropzone to investigate

• Under "Enabled Next-Gen SIEM Case statuses," select the Case statuses you want Dropzone to investigate

• Under "Case Name Regex Filters," you may choose to filter cases by name. To do so, click "Add Item," then input a list of regexes. Under "Case Name Filter mode," select whether to include or include the cases

• If you wish to enable CrowdStrike's Next-Gen SIEM alerts, check the box labeled "Enable Next-gen SIEM Alert"

• Check the box labeled "Include Third Party Sources" if you want Dropzone to be able to ingest Next-gen alerts from other sources integrated into Crowdstrike

• Check the box labeled "Include Falcon Cloud Security Alert" if you want Dropzone to be able to ingest alerts from Crowdstrike's [Falcon Cloud Security]

• Check the box for each severity level of alerts you want Dropzone to investigate

• Under "Next-Gen SIEM Alert Exclusions," you may choose to exclude alerts by display name. To do so, click "Add Item," then input a list of regexes to exclude alerts

• If you wish to enable Dropzone to investigate alerts and cases from specific devices, check the box labeled "Enable Device Tag Filtering"

• Input each device tag individually

• If you wish to enable Dropzone to investigate identity protection alerts, check the box labeled "Enable Identity Protection Alerts"

• Select the severity levels you want Dropzone to investigate alerts for

• Input your Crowdstrike UI Domain for ticket linkback

• If you wish to enable Dropzone to fetch original third party alerts, check the box labeled "Fetch Original Third Party Alerts" under "Next-Gen SIEM Alert Enrichment Options"

• Input your desired poll interval and lookback

• If you wish to further filter alerts using the Python CEL package, check the box labeled "Use advanced filtering"

• Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button

• Contact your Dropzone AI support representative for more information about this feature

• Click "Test & Save" to finish

You should begin ingesting alerts immediately.

If you have any errors engage your Dropzone AI support representative.