Crowdstrike Integration to XSIAM

[PA_nts]

Hi All,

We are running XSIAM with the Crowdstrike Falcon content pack installed, the parsing and datamodeling works.. data is ingesting etc etc.. 

however we are not seeing any alerts being generated as yet.. 

the content pack does not include a realtime correlation rule to pull and map alerts into xsiam.

Has anyone done a custom correlation rule to map alerts from CS into XSIAM? ie duplicating the alerts from CS to XSIAM

please -  no 'AI' copy and paste responses.

thanks in adv

[dfalcon]

Did you ever get this set up correctly?  If not, please DM me.  We created content that has several correlation rules.  The content was created last year so it may need a touch-up.  

[C.CardozoMedina]

Hi,

I get that you need to replicate each field from the CS event into the XSIAM issue context. If that's the case, you should first grab the event schema and create fields with the same names so you can use and set them up in the correlation rule—this is what we did. Or, you can just put everything into a raw field if all you want is to have the ingested CS event. If you think I can help, feel free to reach out. Hope you manage to sort it out. Greetings

[PA_nts]

Correct.. . so we first started with configuring field mappings in correlation, then created issue fields (config > setting > object > issues > fields) then created a new layout and layout rules, then extract fields from the dataset via xql query and configured these fields mappings in correlation..

all in all.. not an easy process :- (

[C.CardozoMedina]

I think everything could be a little easier if in XQL Search -> Schema you could export the fields in JSON format with the same JSON structure as when exporting in Issues -> Fields. With this, you could then import the fields without any problem; that would be a first step.
They could also add an import button to the correlation rule to upload the same JSON in the mapping section by filling in the fields and values automatically and with this just adding, for example,

dataset = crowdstrike_falcon_event_raw | fields *

in the Query of the correlation rule we could generate the issue with replicated fields from CS to XSIAM
I think this could work and could be applied to any dataset