Mengumpulkan log CrowdStrike Falcon

Dokumen ini menjelaskan cara menyerap log CrowdStrike Falcon ke Google Security Operations. Anda dapat menyerap beberapa jenis log CrowdStrike Falcon, dan dokumen ini menguraikan konfigurasi spesifik untuk setiap jenis log.

Untuk ringkasan tingkat tinggi tentang penyerapan data di Google Security Operations, lihat Penyerapan data ke Google Security Operations.

Jenis log CrowdStrike Falcon yang didukung

Google Security Operations mendukung jenis log CrowdStrike Falcon berikut melalui parser dengan label penyerapan berikut:

• Deteksi dan Respons Endpoint (EDR): CS_EDR. Parser ini memproses data telemetri hampir real-time dari CrowdStrike Falcon Data Replicator (FDR), seperti akses file dan modifikasi registri. Data biasanya di-ingest dari bucket S3 atau Cloud Storage.

• Deteksi: CS_DETECTS. Parser ini mem-parsing peristiwa Ringkasan Deteksi dari CrowdStrike menggunakan Detect API. Meskipun terkait dengan aktivitas endpoint, CS_DETECTS memberikan ringkasan deteksi tingkat yang lebih tinggi dibandingkan dengan telemetri mentah yang diuraikan menggunakan CS_EDR.

  Catatan: CrowdStrike telah menghentikan penggunaan endpoint 'Detects'. Sebaiknya gunakan CS_ALERTS untuk menyerap log deteksi.

• Pemberitahuan: CS_ALERTS. Parser ini mem-parsing pemberitahuan dari CrowdStrike menggunakan Alerts API. Parser Notifikasi CrowdStrike mendukung jenis produk berikut:

  • epp
  • idp
  • overwatch
  • xdr
  • mobile
  • cwpp
  • ngsiem

• Indikator Penyusupan (IoC): CS_IOC. Parser ini mem-parsing IoC dan Indikator Serangan (IOA) dari CrowdStrike Threat Intelligence menggunakan CrowdStrike Chronicle Intel Bridge. Parser Indikator Gangguan (IoC) CrowdStrike mendukung jenis indikator berikut:

  • domain
  • email_address
  • file_name
  • file_path
  • hash_md5
  • hash_sha1
  • hash_sha256
  • ip_address
  • mutex_name
  • url

Google SecOps merekomendasikan penggunaan feed untuk CS_EDR, CS_DETECTS, dan CS_IOC untuk penyerapan data yang komprehensif dari CrowdStrike.

Sebelum memulai

Pastikan Anda memiliki prasyarat berikut:

• Hak administrator pada instance CrowdStrike untuk menginstal sensor Host CrowdStrike Falcon
• Semua sistem dalam arsitektur deployment dikonfigurasi dalam zona waktu UTC.
• Perangkat target berjalan di sistem operasi yang didukung
  • Harus berupa server 64-bit
  • Microsoft Windows Server 2008 R2 SP1 didukung untuk sensor Host CrowdStrike Falcon versi 6.51 atau yang lebih baru.
  • Versi OS lama harus mendukung penandatanganan kode SHA-2.
• File akun layanan Google SecOps dan ID pelanggan Anda dari tim dukungan Google SecOps

Menyiapkan feed

Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:

• Setelan SIEM > Feed > Tambahkan Feed Baru
• Hub Konten > Paket Konten > Mulai

Catatan: Hub Konten tidak tersedia di platform mandiri SIEM. Untuk melakukan upgrade, hubungi perwakilan Google SecOps Anda.

Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.

Menyerap log CrowdStrike Falcon

Bagian ini menjelaskan cara mengonfigurasi penyerapan untuk berbagai jenis log CrowdStrike Falcon.

Menyerap log EDR (CS_EDR)

Anda dapat menyerap log EDR CrowdStrike Falcon menggunakan salah satu metode berikut, bergantung pada tempat Anda ingin mengirim log dari CrowdStrike:

• Amazon SQS: Menggunakan feed Falcon Data Replicator.
• Amazon S3: Menggunakan feed Google Security Operations yang dikonfigurasi untuk bucket S3.
• Google Cloud Storage: Dengan membuat CrowdStrike mengirimkan log ke bucket Cloud Storage.

Pilih salah satu prosedur berikut.

Opsi 1: Menyerap log EDR dari Amazon SQS

Metode ini menggunakan CrowdStrike Falcon Data Replicator untuk mengirim log EDR ke antrean Amazon SQS, yang kemudian di-polling oleh Google Security Operations.

1. Klik paket CrowdStrike.

2. Pada jenis log CrowdStrike Falcon, tentukan nilai untuk kolom berikut:

   • Sumber: Amazon SQS
   • Region: Region S3 yang terkait dengan URI.
   • Nama Antrean: Nama antrean SQS yang akan dibaca data lognya.
   • URI S3: URI sumber bucket S3.
   • Nomor Akun: Nomor akun SQS.
   • Queue Access Key ID: ID kunci akses akun 20 karakter. Contoh, AKIAOSFOODNN7EXAMPLE.
   • Queue Secret Access Key: Kunci akses rahasia 40 karakter. Contoh, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY.
   • Opsi penghapusan sumber: Opsi untuk menghapus file dan direktori setelah mentransfer data.

   Opsi lanjutan

   • Nama Feed: Nilai yang telah diisi otomatis yang mengidentifikasi feed.
   • Namespace Aset: Namespace yang terkait dengan feed.
   • Label Penyerapan – Label yang diterapkan ke semua peristiwa dari feed ini.

3. Klik Buat Feed.

Catatan: Hub Konten tidak tersedia di platform mandiri SIEM. Untuk melakukan upgrade, hubungi perwakilan Google SecOps Anda.

Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.

Opsi 2: Menyerap log EDR dari bucket Amazon S3

Metode ini melibatkan penyiapan feed Google Security Operations untuk menarik log EDR langsung dari bucket Amazon S3.

Untuk menyiapkan feed penyerapan menggunakan bucket S3, ikuti langkah-langkah berikut:

1. Buka Setelan SIEM > Feed.
2. Klik Tambahkan Feed Baru.
3. Di halaman berikutnya, klik Konfigurasi satu feed.
4. Di kolom Feed name, masukkan nama untuk feed; misalnya, Crowdstrike Falcon Logs.
5. Di Source type, pilih Amazon S3.
6. Di Log type, pilih CrowdStrike Falcon.
7. Berdasarkan akun layanan dan konfigurasi bucket Amazon S3 yang Anda buat, tentukan nilai untuk kolom berikut:

   Kolom	Deskripsi
   region	URI region S3.
   S3 uri	URI sumber bucket S3.
   uri is a	Jenis objek yang dituju URI (misalnya, file atau folder).
   source deletion option	Opsi untuk menghapus file dan direktori setelah mentransfer data.
   access key id	Kunci akses (string alfanumerik 20 karakter). Misalnya, AKIAOSFOODNN7EXAMPLE.
   secret access key	Kunci akses rahasia (string alfanumerik 40 karakter). Misalnya, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY.
   oauth client id	ID klien OAuth publik.
   oauth client secret	Rahasia klien OAuth 2.0.
   oauth secret refresh uri	URI refresh rahasia klien OAuth 2.0.
   asset namespace	Namespace yang terkait dengan feed.

8. Klik Berikutnya, lalu Kirim.

Opsi 3: Menyerap log EDR dari Cloud Storage

Anda dapat mengonfigurasi CrowdStrike untuk mengirim log EDR ke bucket Cloud Storage, lalu menyerap log ini ke Google Security Operations menggunakan feed. Proses ini memerlukan koordinasi dengan Dukungan CrowdStrike.

1. Hubungi Dukungan CrowdStrike: Buka tiket dukungan dengan CrowdStrike untuk mengaktifkan dan mengonfigurasi pengiriman log EDR ke bucket Cloud Storage Anda. Mereka akan memberikan panduan tentang konfigurasi yang diperlukan.

2. Buat dan beri izin pada bucket Cloud Storage:

   1. Di konsol Google Cloud , buat bucket Cloud Storage baru. Catat nama bucket (misalnya, gs://my-crowdstrike-edr-logs/).
   2. Berikan izin tulis ke akun layanan yang disediakan oleh CrowdStrike. Ikuti petunjuk dari Dukungan CrowdStrike.

3. Konfigurasi feed Google SecOps:

   1. Di instance Google SecOps Anda, buka Settings > Feeds, lalu klik Add New.
   2. Masukkan Nama feed deskriptif (misalnya, CS-EDR-GCS).
   3. Untuk Source type, pilih Google Cloud Storage V2.
   4. Untuk Log type, pilih CrowdStrike Falcon.
   5. Di bagian akun layanan, klik Dapatkan Akun Layanan. Salin alamat email akun layanan unik yang ditampilkan.
   6. Di konsol Google Cloud , buka bucket Cloud Storage Anda dan berikan peran IAM Storage Object Viewer ke alamat email akun layanan yang Anda salin. Hal ini memungkinkan feed membaca file log.
   7. Kembali ke halaman konfigurasi feed Google SecOps.
   8. Masukkan URL Bucket Penyimpanan (misalnya, gs://my-crowdstrike-edr-logs/). URL ini harus diakhiri dengan garis miring (/).
   9. Pilih Opsi Penghapusan Sumber. Sebaiknya pilih Jangan pernah menghapus file.
   10. Klik Berikutnya, tinjau setelan, lalu klik Kirim.

4. Verifikasi penyerapan log: Setelah CrowdStrike mengonfirmasi bahwa log sedang dikirim, periksa log yang masuk di Google SecOps dengan Jenis Log CROWDSTRIKE_EDR.

Menyerap log Alerts (CS_ALERTS)

Untuk menyerap pemberitahuan CrowdStrike Falcon, Anda mengonfigurasi feed yang menggunakan CrowdStrike API.

1. Di Konsol CrowdStrike Falcon:

   1. Login ke Konsol CrowdStrike Falcon.
   2. Buka Support and resources > Resources and tools > API Clients and Keys, lalu klik Create API client.
   3. Masukkan Nama Klien dan Deskripsi.
   4. Untuk Cakupan API, centang kotak Baca dan Tulis untuk Pemberitahuan.
   5. Klik Buat. Catat Client ID, Client Secret, dan Base URL yang dibuat.

2. Di Google Security Operations:

   1. Buka Setelan > Feed, lalu klik Tambahkan Baru.
   2. Pilih Third Party API untuk Source type.
   3. Pilih CrowdStrike Alerts API untuk Log type.
   4. Klik Next dan isi kolom berikut menggunakan nilai dari klien CrowdStrike API:
      • Endpoint token OAuth
      • ID klien OAuth
      • Rahasia klien OAuth
      • URL Dasar
   5. Klik Berikutnya, lalu Kirim.

Menyerap log Deteksi (CS_DETECTS)

Catatan: CrowdStrike telah menghentikan penggunaan endpoint 'Detects'. Sebaiknya gunakan CS_ALERTS untuk menyerap log deteksi.

Untuk menyerap log deteksi CrowdStrike Falcon, Anda juga menggunakan CrowdStrike API.

1. Di Konsol CrowdStrike Falcon:

   1. Login ke Konsol CrowdStrike Falcon.
   2. Buka Support Apps > API Clients and Keys.
   3. Buat pasangan kunci klien API baru. Pasangan kunci ini harus memiliki izin READ untuk Detections.

2. Di Google Security Operations:

   1. Buka Setelan > Feed, lalu klik Tambahkan Baru.
   2. Pilih Third Party API untuk Source type.
   3. Pilih CrowdStrike Detection Monitoring untuk Log type.
   4. Klik Berikutnya, lalu Kirim. Anda akan diminta untuk memasukkan kredensial API yang Anda buat.

Menyerap log IoC (CS_IOC)

Untuk menyerap log Indikator Penyusupan (IoC) dari CrowdStrike, Anda menggunakan Google SecOps Intel Bridge.

1. Di Konsol CrowdStrike Falcon, buat pasangan kunci klien API baru. Pasangan kunci ini harus memiliki izin READ untuk Indicators (Falcon Intelligence).
2. Siapkan Google SecOps Intel Bridge dengan mengikuti petunjuk di CrowdStrike to Google SecOps Intel Bridge.

3. Jalankan perintah Docker berikut untuk mengirim log dari CrowdStrike ke Google SecOps. sa.json adalah file akun layanan Google SecOps Anda.

   docker build . -t ccib:latest
   docker run -it --rm \
         -e FALCON_CLIENT_ID="$FALCON_CLIENT_ID"  \
         -e FALCON_CLIENT_SECRET="$FALCON_CLIENT_SECRET"  \
         -e FALCON_CLOUD_REGION="$FALCON_CLOUD"  \
         -e CHRONICLE_CUSTOMER_ID="$CHRONICLE_CUSTOMER_ID"  \
         -e GOOGLE_APPLICATION_CREDENTIALS=/ccib/sa.json  \
         -v  ~/my/path/to/service/account/filer/sa.json:/ccib/sa.json  \
         ccib:latest
   

4. Setelah container berjalan, log IoC akan mulai di-streaming ke Google SecOps.

Jika Anda mengalami masalah dengan salah satu konfigurasi ini, hubungi tim dukungan SecOps Google.

Delta Pemetaan UDM untuk log pemberitahuan CrowdStrike.

Referensi Delta Pemetaan UDM: CS_ALERTS

Tabel berikut mencantumkan perbedaan antara parser Default CS ALERTS dan versi premium CS ALERTS.

Default UDM Mapping	Log Field	Premium Mapping Delta
about.resource.product_object_id	cid	Removed mapping to avoid duplication, as the cid log field is also mapped to metadata.product_deployment_id.
principal.asset.platform_software.platform	platform	If the device.platform_name log field value is empty and the platform log field value is not empty and if the platform log field value matches the regular expression pattern (?i)Windows then, the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if platform log field value matches the regular expression pattern (?i)Linux then, the principal.asset.platform_software.platform UDM field is set to LINUX. Else, if platform log field value matches the regular expression pattern (?i)Mac then, the principal.asset.platform_software.platform UDM field is set to MAC. Else, if platform log field value matches the regular expression pattern (?i)ios then, the principal.asset.platform_software.platform UDM field is set to IOS.
security_result.detection_fields[agent_id]	agent_id	If the device.device_id log field value is empty and the host_id log field value is empty and the mdm_device_id log field value is empty then, CS:%{agent_id} log field is mapped to the principal.asset_id UDM field. Else, the principal.asset.attribute.labels.key UDM field is set to agent_id and agent_id log field is mapped to the principal.asset.attribute.labels.value UDM field.
security_result.detection_fields[idp_policy_account_event_type]	idp_policy_account_event_type	security_result.rule_labels[idp_policy_account_event_type]
security_result.detection_fields[idp_policy_mfa_factor_type]	idp_policy_mfa_factor_type	security_result.rule_labels[idp_policy_mfa_factor_type]
security_result.detection_fields[idp_policy_mfa_provider_name]	idp_policy_mfa_provider_name	security_result.rule_labels[idp_policy_mfa_provider_name]
security_result.detection_fields[idp_policy_mfa_provider]	idp_policy_mfa_provider	security_result.rule_labels[idp_policy_mfa_provider]
security_result.detection_fields[idp_policy_rule_action]	idp_policy_rule_action	security_result.rule_labels[idp_policy_rule_action]
security_result.detection_fields[idp_policy_rule_trigger]	idp_policy_rule_trigger	security_result.rule_labels[idp_policy_rule_trigger]
security_result.detection_fields[idp_policy_rule_id]	idp_policy_rule_id	security_result.rule_id
security_result.detection_fields[idp_policy_rule_name]	idp_policy_rule_name	security_result.rule_name
security_result.detection_fields[status]	status	If the status log field value matches the regular expression pattern (?i)new then, status log field is mapped to the security_result.about.investigation.status UDM field with the value NEW. Else, if status log field value matches the regular expression pattern (?i)closed then, status log field is mapped to the security_result.about.investigation.status UDM field with the value CLOSED. Else, status log field is mapped to the security_result.detection_fields[status] UDM field.
target.process.file.mime_type	alleged_filetype	If the technique_name log field value contain one of the following values Archive via Library Ingress Tool Transfer Remote File Copy File Transfer Protocols Credentials from Web Browsers Credentials In Files Proc Filesystem Unsecured Credentials File Deletion Obfuscated Files or Information Compile After Delivery Compiled HTML File Deobfuscate/Decode Files or Information Double File Extension File and Directory Permissions Modification File System Logical Offsets Hidden Files and Directories Install Root Certificate Archive Collected Data Archive via Custom Method Archive via Utility Linux and Mac File and Directory Permissions Modification MMC NTFS File Attributes PubPrn Resource Forking Rundll32 Scripting Space after Filename System Script Proxy Execution XSL Script Processing Intelligence Indicator - Hash Known Hash Malicious File File and Directory Discovery AppleScript Command and Scripting Interpreter JavaScript JavaScript/JScript Malicious Image PowerShell Python Service Execution Unix Shell User Execution Data Destruction Spearphishing Attachment .bash_profile and .bashrc Change Default File Association Ccache Files Chat Messages Multi-Factor Authentication TCC Manipulation Application Versioning Fileless Storage Embedded Payloads File/Path Exclusions Encrypted/Encoded File Match Legitimate Resource Name or Location Masquerade File Type Stripped Payloads Clear Network Connection History and Configurations Disable or Modify Linux Audit System Junk Code Insertion Extended Attributes SVG Smuggling Indicator Removal LNK Icon Smuggling Polymorphic Code Relocate Malware Clear Persistence Compression Compromise Host Software Binary Conceal Multimedia Files Browser Information Discovery Taint Shared Content Shared Webroot then, alleged_filetype log field is mapped to the target.file.mime_type UDM field. Else, alleged_filetype log field is mapped to the target.process.file.mime_type UDM field.
principal.resource.product_object_id	device.cid	principal.asset.attribute.labels[device_cid]
security_result.detection_fields[active_directory_dn_display]	device.hostinfo.active_directory_dn_display	Iterate through log field device.hostinfo.active_directory_dn_display, then the security_result.detection_fields.key UDM field is set to device_hostinfo_active_directory_dn_display and device.hostinfo.active_directory_dn_display log field is mapped to the security_result.detection_fields.value UDM field.
principal.asset.platform_software.platform	device.platform_name	If the device.platform_name log field value is not empty and if the device.platform_name log field value matches the regular expression pattern (?i)Windows then, the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if device.platform_name log field value matches the regular expression pattern (?i)Linux then, the principal.asset.platform_software.platform UDM field is set to LINUX. Else, if device.platform_name log field value matches the regular expression pattern (?i)Mac then, the principal.asset.platform_software.platform UDM field is set to MAC. Else, if device.platform_name log field value matches the regular expression pattern (?i)ios then, the principal.asset.platform_software.platform UDM field is set to IOS. if the platform log field value is not empty and the device.platform_name log field value is equal to the platform log field value then, the principal.asset.attribute.labels.key UDM field is set to platform and platform log field is mapped to the principal.asset.attribute.labels.value UDM field.
principal.asset.platform_software.platform_version	device.system_product_name	principal.asset.hardware.model
target.process.file.names	filename	If the technique_name log field value contain one of the following values Archive via Library Ingress Tool Transfer Remote File Copy File Transfer Protocols Credentials from Web Browsers Credentials In Files Proc Filesystem Unsecured Credentials File Deletion Obfuscated Files or Information Compile After Delivery Compiled HTML File Deobfuscate/Decode Files or Information Double File Extension File and Directory Permissions Modification File System Logical Offsets Hidden Files and Directories Install Root Certificate Archive Collected Data Archive via Custom Method Archive via Utility Linux and Mac File and Directory Permissions Modification MMC NTFS File Attributes PubPrn Resource Forking Rundll32 Scripting Space after Filename System Script Proxy Execution XSL Script Processing Intelligence Indicator - Hash Known Hash Malicious File File and Directory Discovery AppleScript Command and Scripting Interpreter JavaScript JavaScript/JScript Malicious Image PowerShell Python Service Execution Unix Shell User Execution Data Destruction Spearphishing Attachment .bash_profile and .bashrc Change Default File Association Ccache Files Chat Messages Multi-Factor Authentication TCC Manipulation Application Versioning Fileless Storage Embedded Payloads File/Path Exclusions Encrypted/Encoded File Match Legitimate Resource Name or Location Masquerade File Type Stripped Payloads Clear Network Connection History and Configurations Disable or Modify Linux Audit System Junk Code Insertion Extended Attributes SVG Smuggling Indicator Removal LNK Icon Smuggling Polymorphic Code Relocate Malware Clear Persistence Compression Compromise Host Software Binary Conceal Multimedia Files Browser Information Discovery Taint Shared Content Shared Webroot then, filename log field is mapped to the target.file.names UDM field. Else, filename log field is mapped to the target.process.file.names UDM field.
target.file.full_path	filepath	If the technique_name log field value contain one of the following values Archive via Library Ingress Tool Transfer Remote File Copy File Transfer Protocols Credentials from Web Browsers Credentials In Files Proc Filesystem Unsecured Credentials File Deletion Obfuscated Files or Information Compile After Delivery Compiled HTML File Deobfuscate/Decode Files or Information Double File Extension File and Directory Permissions Modification File System Logical Offsets Hidden Files and Directories Install Root Certificate Archive Collected Data Archive via Custom Method Archive via Utility Linux and Mac File and Directory Permissions Modification MMC NTFS File Attributes PubPrn Resource Forking Rundll32 Scripting Space after Filename System Script Proxy Execution XSL Script Processing Intelligence Indicator - Hash Known Hash Malicious File File and Directory Discovery AppleScript Command and Scripting Interpreter JavaScript JavaScript/JScript Malicious Image PowerShell Python Service Execution Unix Shell User Execution Data Destruction Spearphishing Attachment .bash_profile and .bashrc Change Default File Association Ccache Files Chat Messages Multi-Factor Authentication TCC Manipulation Application Versioning Fileless Storage Embedded Payloads File/Path Exclusions Encrypted/Encoded File Match Legitimate Resource Name or Location Masquerade File Type Stripped Payloads Clear Network Connection History and Configurations Disable or Modify Linux Audit System Junk Code Insertion Extended Attributes SVG Smuggling Indicator Removal LNK Icon Smuggling Polymorphic Code Relocate Malware Clear Persistence Compression Compromise Host Software Binary Conceal Multimedia Files Browser Information Discovery Taint Shared Content Shared Webroot then, filepath log field is mapped to the target.file.full_path UDM field. Else, filepath log field is mapped to the target.process.file.full_path UDM field. If the product log field value is equal to epp and the type log field value is equal to ofp and if the macros.ioc_description log field value is not empty then, macros.ioc_description log field is mapped to the target.file.full_path UDM field and the security_result.detection_fields.key UDM field is set to filepath and filepath log field is mapped to the security_result.detection_fields.value UDM field.
target.process_ancestors.command_line	grandparent_details.cmdline	target.process.parent_process.parent_process.command_line
target.process_ancestors.file.names	grandparent_details.filename	target.process.parent_process.parent_process.file.names
target.process_ancestors.file.full_path	grandparent_details.filepath	target.process.parent_process.parent_process.file.full_path
target.process_ancestors.file.md5	grandparent_details.md5	target.process.parent_process.parent_process.file.md5
target.process_ancestors.product_specific_process_id	grandparent_details.process_graph_id	If the grandparent_details.process_graph_id log field value is not empty then, PRODUCT_SPECIFIC_PROCESS_ID: %{grandparent_details.process_graph_id} log field is mapped to the target.process.parent_process.parent_process.product_specific_process_id UDM field.
target.process_ancestors.pid	grandparent_details.process_id	target.process.parent_process.parent_process.pid
target.process_ancestors.file.sha256	grandparent_details.sha256	target.process.parent_process.parent_process.file.sha256
security_result.detection_fields[ioc_description]	ioc_context.ioc_description	Iterate through log field ioc_context, then the security_result.detection_fields.key UDM field is set to ioc_context_ioc_description and ioc_context.ioc_description log field is mapped to the security_result.detection_fields.value UDM field.
security_result.detection_fields[ioc_source]	ioc_context.ioc_source	Iterate through log field ioc_context, then the security_result.detection_fields.key UDM field is set to ioc_context_ioc_source and ioc_context.ioc_source log field is mapped to the security_result.detection_fields.value UDM field.
target.process.file.md5	md5	If the technique_name log field value contain one of the following values Archive via Library Ingress Tool Transfer Remote File Copy File Transfer Protocols Credentials from Web Browsers Credentials In Files Proc Filesystem Unsecured Credentials File Deletion Obfuscated Files or Information Compile After Delivery Compiled HTML File Deobfuscate/Decode Files or Information Double File Extension File and Directory Permissions Modification File System Logical Offsets Hidden Files and Directories Install Root Certificate Archive Collected Data Archive via Custom Method Archive via Utility Linux and Mac File and Directory Permissions Modification MMC NTFS File Attributes PubPrn Resource Forking Rundll32 Scripting Space after Filename System Script Proxy Execution XSL Script Processing Intelligence Indicator - Hash Known Hash Malicious File File and Directory Discovery AppleScript Command and Scripting Interpreter JavaScript JavaScript/JScript Malicious Image PowerShell Python Service Execution Unix Shell User Execution Data Destruction Spearphishing Attachment .bash_profile and .bashrc Change Default File Association Ccache Files Chat Messages Multi-Factor Authentication TCC Manipulation Application Versioning Fileless Storage Embedded Payloads File/Path Exclusions Encrypted/Encoded File Match Legitimate Resource Name or Location Masquerade File Type Stripped Payloads Clear Network Connection History and Configurations Disable or Modify Linux Audit System Junk Code Insertion Extended Attributes SVG Smuggling Indicator Removal LNK Icon Smuggling Polymorphic Code Relocate Malware Clear Persistence Compression Compromise Host Software Binary Conceal Multimedia Files Browser Information Discovery Taint Shared Content Shared Webroot then, md5 log field is mapped to the target.file.md5 UDM field. Else, md5 log field is mapped to the target.process.file.md5 UDM field.
target.process.file.sha1	sha1	If the technique_name log field value contain one of the following values Archive via Library Ingress Tool Transfer Remote File Copy File Transfer Protocols Credentials from Web Browsers Credentials In Files Proc Filesystem Unsecured Credentials File Deletion Obfuscated Files or Information Compile After Delivery Compiled HTML File Deobfuscate/Decode Files or Information Double File Extension File and Directory Permissions Modification File System Logical Offsets Hidden Files and Directories Install Root Certificate Archive Collected Data Archive via Custom Method Archive via Utility Linux and Mac File and Directory Permissions Modification MMC NTFS File Attributes PubPrn Resource Forking Rundll32 Scripting Space after Filename System Script Proxy Execution XSL Script Processing Intelligence Indicator - Hash Known Hash Malicious File File and Directory Discovery AppleScript Command and Scripting Interpreter JavaScript JavaScript/JScript Malicious Image PowerShell Python Service Execution Unix Shell User Execution Data Destruction Spearphishing Attachment .bash_profile and .bashrc Change Default File Association Ccache Files Chat Messages Multi-Factor Authentication TCC Manipulation Application Versioning Fileless Storage Embedded Payloads File/Path Exclusions Encrypted/Encoded File Match Legitimate Resource Name or Location Masquerade File Type Stripped Payloads Clear Network Connection History and Configurations Disable or Modify Linux Audit System Junk Code Insertion Extended Attributes SVG Smuggling Indicator Removal LNK Icon Smuggling Polymorphic Code Relocate Malware Clear Persistence Compression Compromise Host Software Binary Conceal Multimedia Files Browser Information Discovery Taint Shared Content Shared Webroot then, sha1 log field is mapped to the target.file.sha1 UDM field. Else, sha1 log field is mapped to the target.process.file.sha1 UDM field.
target.file.sha256	sha256	If the technique_name log field value contain one of the following values Archive via Library Ingress Tool Transfer Remote File Copy File Transfer Protocols Credentials from Web Browsers Credentials In Files Proc Filesystem Unsecured Credentials File Deletion Obfuscated Files or Information Compile After Delivery Compiled HTML File Deobfuscate/Decode Files or Information Double File Extension File and Directory Permissions Modification File System Logical Offsets Hidden Files and Directories Install Root Certificate Archive Collected Data Archive via Custom Method Archive via Utility Linux and Mac File and Directory Permissions Modification MMC NTFS File Attributes PubPrn Resource Forking Rundll32 Scripting Space after Filename System Script Proxy Execution XSL Script Processing Intelligence Indicator - Hash Known Hash Malicious File File and Directory Discovery AppleScript Command and Scripting Interpreter JavaScript JavaScript/JScript Malicious Image PowerShell Python Service Execution Unix Shell User Execution Data Destruction Spearphishing Attachment .bash_profile and .bashrc Change Default File Association Ccache Files Chat Messages Multi-Factor Authentication TCC Manipulation Application Versioning Fileless Storage Embedded Payloads File/Path Exclusions Encrypted/Encoded File Match Legitimate Resource Name or Location Masquerade File Type Stripped Payloads Clear Network Connection History and Configurations Disable or Modify Linux Audit System Junk Code Insertion Extended Attributes SVG Smuggling Indicator Removal LNK Icon Smuggling Polymorphic Code Relocate Malware Clear Persistence Compression Compromise Host Software Binary Conceal Multimedia Files Browser Information Discovery Taint Shared Content Shared Webroot then, sha256 log field is mapped to the target.file.sha256 UDM field. Else, sha256 log field is mapped to the target.process.file.sha256 UDM field. If the product log field value is equal to epp and the type log field value is equal to ofp and if the ioc_type log field value is equal to hash_sha256 and the macros.ioc_value log field value is not empty then, macros.ioc_value log field is mapped to the target.file.sha256 UDM field and the security_result.detection_fields.key UDM field is set to sha256 and sha256 log field is mapped to the security_result.detection_fields.value UDM field.
target.asset.platform_software.platform	operating_system	If the operating_system log field value matches the regular expression pattern (?i)Windows then, the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if operating_system log field value matches the regular expression pattern (?i)linux then, the principal.asset.platform_software.platform UDM field is set to LINUX. Else, if operating_system log field value matches the regular expression pattern (?i)ios then, the principal.asset.platform_software.platform UDM field is set to IOS. Else, if operating_system log field value matches the regular expression pattern (?i)mac then, the principal.asset.platform_software.platform UDM field is set to MAC.
security_result.detection_fields[agent_version]	agent_version	principal.asset.attribute.labels[agent_version]
about.email	enrollment_email	principal.user.email_addresses
principal.asset.type		If the mdm_device_id log field value is not empty or the mobile_hardware log field value is not empty or the mobile_manufacturer log field value is not empty or the mobile_serial log field value is not empty then, the principal.asset.type UDM field is set to MOBILE.
security_result.detection_fields[detection_context_user_is_admin]	detection_context.user_is_admin	security_result.about.user.attribute.label[detection_context_user_is_admin]
security_result.detection_fields[detection_context_user_sid]	detection_context.user_sid	security_result.about.user.attribute.label[detection_context_user_sid]
principal.asset.attribute.labels[pod_id]	device.pod_id	principal.resource.product_object_id
principal.asset.attribute.labels[pod_labels]	device.pod_labels	principal.resource.attribute.labels[pod_labels]
principal.asset.attribute.labels[pod_name]	device.pod_name	principal.resource.name
principal.asset.attribute.labels[pod_namespace]	device.pod_namespace	principal.resource.attribute.labels[pod_namespace]
principal.asset.attribute.labels[pod_service_account_name]	device.pod_service_account_name	principal.resource.attribute.labels[pod_service_account_name]

Format log CrowdStrike yang didukung

Parser CrowdStrike mendukung log dalam format JSON.

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.