# CrowdStrike

The Dropzone AI platform integrates with the CrowdStrike APIs. This document describes how to set up API credentials and install them into the Dropzone platform.

## Integration Overview

To enable these integrations you will perform the following actions:

* Create API credentials in the CrowdStrike dashboard
* Install the credentials into your Dropzone tenant (Data Source and Alert Source)
* Select integration parameters, such as which alert types to sync

## Create an API Key

* As an Admin, go to your CrowdStrike dashboard, e.g. https://*falcon.us-#*.crowdstrike.com/
* From the menu in the upper left, navigate to Support and Resources > API clients and keys

* On the right, click "Create API Client"

* On the "Create API Client" page, input "Dropzone AI" in the client name field. Under "Description," write "Dropzone AI Integration Key"

* Enable the following scopes:

| Scope                         | Read | Write | Used By                        |
| ----------------------------- | ---- | ----- | ------------------------------ |
| Alerts                        | ✓    |       | Alert Source, Data Source      |
| API Integrations              | ✓    |       | Alert Source, Data Source      |
| Cases                         | ✓    | ✓     | Alert Source, Data Source      |
| Detections                    | ✓    |       | Alert Source, Data Source      |
| Hosts                         | ✓    | ✓     | Data Source, Remediator Source |
| NGSIEM                        | ✓    | ✓     | Data Source                    |
| Incidents                     | ✓    |       | Alert Source, Data Source      |
| Quarantined Files             | ✓    |       | Data Source                    |
| Real Time Response            | ✓    | ✓     | Data Source                    |
| Event Streams                 | ✓    |       | Data Source                    |
| Threatgraph                   | ✓    |       | Data Source                    |
| Identity Protection Entities  | ✓    |       | Data Source                    |
| Identity Protection Timeline  | ✓    |       | Data Source                    |
| Identity Protection GraphQL   |      | ✓     | Data Source                    |
| Sandbox (Falcon Intelligence) | ✓    | ✓     | Data Source                    |
| Indicators of Compromise      | ✓    | ✓     | Remediator Source              |

* Write permission details
  * `Cases`: Write permissions are only required when used in Response Actions
  * `Hosts`: Write permissions are only required when used in Remediator Containment Actions
  * `NGSIEM`: Write permissions are required when NextGen SIEM is enabled in order to execute NGSIEM queries ([docs](https://www.falconpy.io/Service-Collections/NGSIEM.html#startsearchv1))
  * `Real Time Response`: Write permissions are required when File Retrieval is enabled ([docs](https://www.falconpy.io/Service-Collections/Real-Time-Response.html#rtr_executeactiverespondercommand))
    * Dropzone *only* uses Real Time Response to perform `get <file>` commands
  * `Identity Protection GraphQL`: Write permissions are required when Identity Protection is enabled in order to execute queries for user directory information ([docs](https://www.falconpy.io/Service-Collections/Identity-Protection.html#api_preempt_proxy_post_graphql))
  * `Sandbox (Falcon Intelligence`: Write permissions are only required when File Detonation is enabled in order to upload collected or attached files in the Falcon Sandbox
  * `Indicators of Compromise`: Write permissions are only required when used in Remediator Containment Actions
* When done, click "Create"
* Copy the Client ID and Secret for use later in the Dropzone UI where they are called "Client ID" and "Client Secret" respectively

## Enable Crowdstrike

The Alert source integration allows Dropzone AI to pull alerts from CrowdStrike for investigation.

You'll need the following information:

| Dropzone Field | Source                                   |
| -------------- | ---------------------------------------- |
| Client ID      | The "Client ID" value you copied earlier |
| Client Secret  | The "Secret" value you copied earlier    |

To enable the Alert Source integration, do the following:

* Navigate to your Dropzone AI tenant home page e.g. https://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > Integrations

* Click "Available"

* In the Search bar, search CrowdStrike, then click "Configure"

* Under the Alert Source header, input the Client ID and Client Secret. If you use a non-default URL for the CrowdStrike API, configure the API Base URL as well

* If you wish to enable endpoint detection, check the box labeled "Enable Endpoint Detection." Then select the severity levels you want Dropzone to investigate alerts for
* Under Exclusions, you may choose to exclude alerts by display name. To do so, click "Add Item," then input a list of [Python regexes](https://docs.python.org/3/library/re.html) of the alerts you wish to exclude

* If you wish to enable CrowdStrike's [Next-Gen SIEM](https://developer.crowdstrike.com/docs/ng-siem/) cases, check the box labeled "Enable Next-gen SIEM Cases"
* Input the minimum case severity you want Dropzone to investigate
* Under "Enabled Next-Gen SIEM Case statuses," select the Case statuses you want Dropzone to investigate

* Under "Case Name Regex Filters," you may choose to filter cases by name. To do so, click "Add Item," then input a list of regexes. Under "Case Name Filter mode," select whether to include or include the cases

* If you wish to enable CrowdStrike's [Next-Gen SIEM](https://developer.crowdstrike.com/docs/ng-siem/) alerts, check the box labeled "Enable Next-gen SIEM Alert"
* Check the box labeled "Include Third Party Sources" if you want Dropzone to be able to ingest Next-gen alerts from other sources integrated into Crowdstrike
* Check the box labeled "Include Falcon Cloud Security Alert" if you want Dropzone to be able to ingest alerts from Crowdstrike's [Falcon Cloud Security]
* Check the box for each severity level of alerts you want Dropzone to investigate

* Under "Next-Gen SIEM Alert Exclusions," you may choose to exclude alerts by display name. To do so, click "Add Item," then input a list of regexes to exclude alerts

* If you wish to enable Dropzone to investigate alerts and cases from specific devices, check the box labeled "Enable Device Tag Filtering"
* Input each device tag individually

* If you wish to enable Dropzone to investigate [identity protection alerts](https://www.crowdstrike.com/wp-content/uploads/2021/06/CrowdStrike-Falcon-Identity-Protection-Modules_DataSheet.pdf), check the box labeled "Enable Identity Protection Alerts"
* Select the severity levels you want Dropzone to investigate alerts for

* Input your Crowdstrike UI Domain for ticket linkback
* If you wish to enable Dropzone to fetch original third party alerts, check the box labeled "Fetch Original Third Party Alerts" under "Next-Gen SIEM Alert Enrichment Options"

* Input your desired poll interval and lookback

* If you wish to further filter alerts using the Python [CEL](https://python-common-expression-language.readthedocs.io/en/stable/tutorials/cel-language-basics/) package, check the box labeled "Use advanced filtering"
* Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button
* Contact your Dropzone AI support representative for more information about this feature

* Click "Test & Save" to finish

You should begin ingesting alerts immediately.

If you have any errors engage your Dropzone AI support representative.